Magnetic disk apparatus

ABSTRACT

A magnetic disk apparatus includes at least two systems, each system having at least one power unit and at least one battery unit ancillary to the power unit. The disk apparatus also includes at least one common power unit having a pluralities of batteries attached thereto connected in common with the two systems. Patrol control means (PC) is operatively connected to a power control unit (0) of one system and a power control unit (1) of another system for giving a control signal during a battery monitoring operation and a priority order to the battery monitoring operation. The patrol control means monitors the function of the common batteries attached to the common power unit and, further, when the common batteries are incorporated in the magnetic disk apparatus, controls the simultaneous monitoring of the common batteries and the time of incorporation of the common batteries into the magnetic disk apparatus. When one of the at least two systems is monitoring the common batteries, the power control unit of the one of the at least two system sends a master signal MAS to the patrol control means (PC) indicating that the one of the at least two systems is monitoring the common batteries, and the patrol control means sends an other-system patrol signal O-TST to the other of the at least two system indicating that the one of the two at least two system is monitoring the common batteries.

This is a divisional of application Ser. No. 08/798,041, filed Jan. 2,1997, U.S. Pat. No. 5,915,122, issued Jun. 22, 1999.

TECHNICAL FIELD

The present invention relates to a magnetic disk apparatus used as asubsystem of a computer system, and more particularly relates to theimprovement of the compactness and density of a magnetic disk apparatusused as a subsystem of a medium-sized host computer system and a controlsystem for a back-up power supply housed in the same. More specifically,it relates to the internal construction for increasing the compactnessand density of a locker type magnetic disk apparatus housing a back-uppower supply and a magnetic disk control apparatus in addition to aplurality of magnetic disk modules, relates to a magnetic disk apparatusin which there is a back-up control system for the supply of power froma battery unit during a power failure, relates to a method of activationof a plurality of magnetic disk modules in a magnetic disk apparatus,relates to the monitoring of the power for controlling the switching ofone system with another system and the back-up batteries which areattached to the two systems, relates to the control of the cut-off ofpower in a magnetic disk apparatus, and relates to a device for thedisplay of the state of the power in a magnetic disk apparatus.

BACKGROUND ART

The demands on the reliability of computer systems are extremely high. Asystem which can continue its normal system operation even when powerhas failed due to external factors such as a breakdown of the powerfacilities of the computer system or lightning, a system which cancomplete the processing currently in progress normally even when thepower has failed for more than an allowable extent, and a system whichcan guarantee the safety of the data being written into the magneticdisk apparatus are demanded.

Therefore, even in a magnetic disk apparatus provided as a subsystem ofa computer, it is necessary to control the power to enable efficient andinexpensive back-up when the input power has failed.

In general, for example, a 60 to 360 Gbyte magnetic disk apparatusconnected to a large-sized computer system installed in a computercenter is provided with a full-scale power facility along with thelarge-sized computer system, so no battery is provided in the magneticdisk apparatus itself.

That is, the large-sized computer system and the magnetic disk apparatusreceive the supply of power from a common power facility. In this case,the power facility is provided with an external power supply and aback-up battery and further is provided with an emergency generator insome cases. In general, the back-up battery is large in capacity andtherefore there are various restrictions as to the construction andappearance of the battery due to provisions of fire prevention laws, sothe installation space becomes large.

On the other hand, a medium-sized computer system installed in a generaloffice etc. uses a medium-sized magnetic disk apparatus of for example a5 to 20 Gbyte capacity. In the case of such a medium-sized computersystem, there is no full-scale power facility provided as in the case ofa large-sized computer system. Rather, the commercial power is used.Therefore, it is necessary to provide a back-up battery for the magneticdisk apparatus in this case.

In a medium-sized computer system, however, when providing a back-upbattery in the magnetic disk apparatus, it is necessary to make theinstallation space of the battery as small as possible and also to limitthe battery to the range of power capacity which is free fromrestriction under fire prevention laws. On the other hand, no matter howsmall the battery capacity, back-up power is required and must beguaranteed. In this case, the consumption (discharge) of the batterywhen power fails or is momentarily cut off is remarkable. If the batterycannot be charged fast enough, then there is the danger that back-up ofpower can no longer be guaranteed for the system.

Accordingly, in a magnetic disk apparatus used for a medium-sizedcomputer system, a key problem is how to suppress the consumption of theback-up battery as much as possible.

On the other hand, a magnetic disk apparatus carries a plurality ofcompact magnetic disk modules in a single locker. If all the modules areactivated at once, then current of a level several times the steadystate flows and a large capacity of power becomes required. Accordingly,the modules are activated in succession so as prevent the rush currentfrom overlapping. To achieve further compactness of the powerfacilities, however, it is desired to control the activation even finer.

Further, improvements are required in the monitoring of the power, thebattery test, the analysis of the causes at the time of power failure,the display for maintenance of the power, etc.

DISCLOSURE OF THE INVENTION

A first object of the present invention lies in the improvement of theinternal mounting structure of the magnetic disk apparatus, that is,lies in the increase of the number of magnetic disk modules mounted inthe housing (locker) of the magnetic disk apparatus and the improvementof the mounting density and lies in the structure of a magnetic diskapparatus of the locker storage type which can keep down the amount ofcables used and achieve a higher density of mounting when providing aplurality of power units and back-up battery units, a magnetic diskcontrol apparatus, etc.

A second object of the present invention lies in improvement of thecontrol at the time of a power failure, that is, lies in enabling asuitable cut-off of the power without causing abnormal ending of thesystem or destruction of data even when a power failure occurs beforethe completion of charging of the battery.

Further, a third object of the present invention lies in improvement ofthe back-up control, that is, lies in enabling suitable control of theback-up in the event power stops being input in the case of provision ofa battery unit in the apparatus itself.

A fourth object of the present invention lies in the improvement of themethod of activation of the magnetic disk apparatus, that is, lies insuppression of the activation power and shortening of the start-up time.

Further, a fifth object of the present invention lies in monitoring ofthe power, in particular the battery, that is, lies in providing powermonitoring times at suitable times and the control of the competitionbetween two systems so as to quickly enable incorporation of a batteryin the system.

Also, a sixth object of the present invention lies in the monitoring ofthe battery, as above, in this case the prevention of competition duringbattery tests.

A seventh object of the present invention lies in control of the cut-offof the power, that is, lies in enabling easy analysis of the causes of acut-off of the power.

Further, an eighth object of the present invention lies in enablingreliable prevention of omission of switching of an R/L switch at thetime of the end of the maintenance work on the magnetic disk apparatusand the power apparatus.

To achieve the above objects, the present invention provides a magneticdisk apparatus which is used as a subsystem of a computer system, inparticular, a medium-sized computer system which uses commercial powerand does not have a back-up power supply itself, provided with:

a plurality of directors,

a plurality of magnetic disk modules commonly accessed from theplurality of directors,

a plurality of director batteries for supplying power individually tothe plurality of directors,

magnetic disk module batteries for supplying power to the magnetic diskmodules, and

a power controller for independently controlling the supply of powerfrom the plurality of director batteries and magnetic disk modulebatteries in accordance with the operating state of the plurality ofdirectors and magnetic disk modules.

Further, the present invention provides a magnetic disk apparatus whichis used as a subsystem of a computer system, in particular, amedium-sized computer system which uses commercial power and does nothave a back-up power supply itself, which magnetic disk apparatus has astructure accommodating in a housing a plurality of magnetic diskmodules comprised as independent units and a plurality of power unitsoutputting a predetermined DC voltage to the magnetic disk modules,characterized in that the plurality of power units are connected to asingle mother board to form a common power supply.

As an embodiment, the mother board has connected to it back-up batteryunits in addition to the power units.

As an embodiment, the power units are connected to one side of themother board and the back-up battery units are connected to the otherside.

As an embodiment, the battery units output the same DC voltage as thepower units.

As an embodiment, the power units are connected to the mother board bybeing plugged in.

As an embodiment, the battery units are connected to the mother board bybeing plugged in.

As an embodiment, a plurality of mother boards with a plurality of powerunits connected to them are provided and the power lines among theplurality of mother boards are connected in common to form a commonpower supply.

As an embodiment, the magnetic disk modules house DC/DC converters whichconvert the DC input voltage from the power units to a predetermined DCvoltage and supply that as power.

As an embodiment, the magnetic disk modules, power units, and motherboard are mounted in a single housing along with the magnetic diskcontrol apparatus of the magnetic disk modules.

As an embodiment, the magnetic disk modules and the magnetic diskcontrol apparatus are provided with DC/DC converters which receive thesame DC input voltage and output a particular DC voltage.

Further, the present invention provides a magnetic disk apparatus whichis provided with magnetic disk modules connected under the control of amagnetic disk control means, power units which convert the input voltagefrom an outside power supply to a predetermined DC voltage and supplythe same to the magnetic disk modules, battery units which supply themagnetic disk modules with the same DC voltage as the power units, and apower control means which controls the input and cut-off of the power ofthe power units and the magnetic disk modules, wherein provision isfurther made of:

charging completion detecting means which are provided in the batteryunits and judge the completion of charging of the batteries accommodatedwhen the charging current becomes less than a predetermined value andoutput a charging completion notification signal to the power controlmeans and

a charging completion invalidating means which is provided in the powercontrol means and invalidates the charging completion detection signaloutput from the charging completion detecting means at the time ofdetecting a power failure, whereby

when a charging completion notification signal is output while thecharging current falls as a result of a power failure caused before thecompletion of charging, it can be judged that the charging has not yetbeen completed at the time of detection of the power failure.

As an embodiment, provision is further made of a delaying means forcausing a delay of a predetermined time to the charging completionnotification signal from the charging completion detecting means andthen supplies the same to the power control means and, when the chargingcompletion notification signal is output while the charging current isfalling due to a power failure caused before the completion of charging,the charging completion notification signal is received after a powerfailure detection time of the power control means at a delay caused bythe delay means, and it is judged that the charging has not yet beencompleted at the time of detection of the power failure.

As an embodiment, provision is further made of a charging completionjudging means which is provided at the power control means, reads in andholds the charging completion notification signal at predeterminedintervals, reads out the charging completion detection signal detected apredetermined time before when detecting a power failure, and judges theexistence of the completion of charging and also, when a chargingcompletion notification signal is output while the charging current isfalling due to a power failure occurring before the completion ofcharging, it can be judged that the charging has not yet been completedat the time of the detection of the power failure.

As an embodiment, when it is judged that the charging has been completedat the time of the detection of the power failure the power controlmeans instructs the magnetic disk control means to disconnect themagnetic disk modules when a predetermined back-up time (T1) has elapsedand stops the supply of power by the power units when receiving from themagnetic disk control means a cut-off authorization response.

As an embodiment, the power control means stops the supply of power bythe power units without receiving the cut-off authorization responsewhen it does not receive the cut-off authorization response from themagnetic disk control means even after the elapse of a predeterminedtime (T₂) from when the cut-off request was made.

Further, the present invention provides a magnetic disk apparatusprovided with a main power unit provided with power units which receiveas input an AC power and convert the same to DC voltage and batteryunits which are charged by the DC voltage of the power units and outputthe same DC voltage at the time of a power failure, magnetic diskmodules which operate receiving the power from the main power unit, amagnetic disk control unit which receives the power from the main powerunit and controls the magnetic disk modules, and a power control unitwhich controls the input and cut-off of power from the main power unitto the magnetic disk modules and the magnetic disk control unit, whereinprovision is further made of, in the power control unit,

a power failure detecting means for detecting the stopping of the inputof the AC power,

a first timer which activates when the power failure detecting meansdetects a power failure, monitors the time during which the input ofpower has stopped, and produces a timer output when a predeterminedback-up time (T₁) has been reached, and

a back-up control means for executing a power cut-off processing of themagnetic disk modules and magnetic disk control unit on the basis of apower cut-off command which it receives from a higher apparatus beforethe timer output of the first timer and executes a power cut-offprocessing of the magnetic disk modules and the magnetic disk controlunit when not receiving a command for power cut-off from the higherapparatus, but when the first timer output is obtained.

As an embodiment, the back-up control means, as the power cut-offprocessing of the magnetic disk modules and the magnetic disk controlunit, outputs a power cut-off control signal to the magnetic diskcontrol unit to cause the input and output operation of the magneticdisk unit to end and, when receiving a cut-off authorizationnotification signal on the basis of the end of the input and outputoperation from the magnetic disk control unit, cuts off the power of themagnetic disk modules and the magnetic disk control unit.

As an embodiment, the power control unit is provided with a second timerwhich activates simultaneously with when a power cut-off control signalis output from the back-up control unit to the magnetic disk controlunit, monitors the end of the input and output operation of the magneticdisk modules, and produces a timer output when a predetermined time (T₂)has been reached, wherein the back-up control means cuts the power ofthe magnetic disk modules and the magnetic disk control unit on thebasis of a power cut-off authorization notification received from themagnetic disk control apparatus before the timer output of the secondtimer and cuts off the power of the magnetic disk modules and themagnetic disk control unit when not receiving the power cut-offauthorization notification from the magnetic disk control apparatus, butwhen the timer output of the second timer is obtained.

As an embodiment, the back-up control means stops the back-up operationand causes the operation of the apparatus to continue by clearing thefirst timer when restoration of the power input is detected after thedetection of a power failure.

As an embodiment, when detecting the restoration of power input afteractivation of the second timer, the back-up control means clears thesecond timer and also prohibits a cut-off operation on the basis of apower cut-off authorization notification from the magnetic disk controlunit and causes the operation of the apparatus to continue.

Further, the present invention provides a method for activation of amagnetic disk apparatus activated by input of power of a plurality ofmagnetic disk modules, wherein the plurality of magnetic disk modulesare divided into a plurality of groups of the same number of units andthe groups are activated in succession by changing the time intervalsfor each of the same.

As an embodiment, the groups are successively activated by shifting themat least by the time (ΔT) during which a rush current flows just afteractivation.

As an embodiment, first two groups are successively activated byshifting them by exactly the time (ΔT) during which the rush currentflows just after activation, then the succeeding groups are activatedsuccessively and repeatedly without overlap after the end of activationof the second activated group.

As an embodiment, processing is repeated so as to successively activatetwo groups by shifting them by exactly the time (ΔT) during which therush current flows just after activation and similarly successivelyactivates the next two groups after the end of activation of the secondactivated group.

Further, the present invention provides a method of activation of amagnetic disk apparatus activated by input of power of the plurality ofmagnetic disk modules, wherein the plurality of magnetic disk modulesare divided into a plurality of groups of mutually different numbers ofunits and the groups are activated successively in the order of thegroups with the greater number of units by shifting each group apredetermined time interval.

As an embodiment, the groups are successively activated by shifting themabout half of the activation time each.

Further, the present invention provides a method of activation of amagnetic disk apparatus activated by input of power of the plurality ofmagnetic disk modules, wherein the plurality of magnetic disk modulesare divided into a plurality of groups of mutually different numbers ofunits and the groups are activated successively by changing the timeintervals of activation for each group.

As an embodiment, the groups are successively activated by shifting themat least by the time (ΔT) during which a rush current flows just afteractivation.

As an embodiment, processing is repeated so as to successively activatetwo groups by shifting them by exactly the time (ΔT) during which a rushcurrent flows just after activation and then similarly successivelyactivate the next two groups after the end of the activation of thesecond activated group.

Further, the present invention provides a magnetic disk apparatus havingpower units of a plurality of systems and battery units ancillary to thepower units and has power units and batteries common with other systems,wherein

provision is made between the power control apparatus of one system andthe power control unit of another system a patrol control means forgiving a signal during a battery monitoring operation and a priorityorder to the battery monitoring, which is used to monitor the functionof the batteries attached to a common power supply and, further, whenincorporated in a magnetic disk apparatus, controls the simultaneousmonitoring of batteries and the time of incorporation of the batteriesinto the magnetic disk apparatus.

As an embodiment, the power control apparatus monitors the ready statesof the batteries at suitable times and when detecting that a battery isin a ready state enabling back-up, immediately starts the monitoringoperation of the battery and, if the battery functions are suitable,incorporates the battery into the system.

As an embodiment, when its own apparatus is doing the monitoring, thepower control means sends a master signal to that effect to the patrolcontrol means and the patrol control means sends an other-system patrolsignal to the power control apparatus at the side not receiving themaster signal indicating that another system is in operation to monitorthe battery.

Further, the present invention provides a magnetic disk apparatus havingin each of a plurality of systems power units and battery unitsancillary to the power units and having power units and batteries commonwith other systems, wherein

provision is made of a cross control means for cross-controlling theconnection to the common power supply and batteries between the powercontrol apparatus of one system and the power control unit of anothersystem and provision is made of an address setting means for setting theaddress showing one's own apparatus in each of the power controlapparatuses and

the cross control means is switched based on the address of the selectedone system, whereby the common power units and attached batteries aremade common to two systems.

As an embodiment, the battery test and monitoring are performed onlyfrom one system by setting the address of one's own system by theaddress setting means.

The present invention further provides a magnetic disk control apparatusprovided with at least a main power unit and a functional unit andperforming the control of the cut-off of the power, wherein

provision is made, in each of the drive modules, of a power unit forsupplying power and a battery unit for backing up the power at the timeof a power failure, while provision is made in the functional unit of afirst storage means for recording the history such as the occurrence ofbreakdowns and also a second storage means for obtaining a log of thestate of use of the power,

the main power unit sending to the functional unit when the power of thesystem is cut off a back-up signal indicating that the back-up batteryis being used due to a power failure and an automatic cut-off signalindicating that the power is automatically cut off along with the elapseof a maximum discharge time after switching to the battery, and

next, when a power cut-off request signal is sent from the main powerunit to the functional unit and the functional unit receives the powercut-off request signal, the functional unit performs a predeterminedprocessing including preparations for power cut-off, then sends a powercut-off signal to the main power unit; the second storage means of thefunctional unit logs the back-up signal and the automatic cut-off signalwhen receiving the power cut-off request signal; and the second storagemeans is referred to so as to judge the state of use of the power suchas the previous power cut-off when next inputting power.

As an embodiment, the automatic cut-off signal is set to a high levelwhen notifying the fact that the power is automatically cut off afterthe elapse of a maximum discharge time of the battery and is set to thelow level when the power is forcibly cut off before the elapse of themaximum discharge time.

As an embodiment, the second storage means uses a part of the memoryarea of the first storage means.

As an embodiment, the first and second storage means use a hard disk.

Further, the present invention provides a magnetic disk apparatus whichdisplays the state of the power, which is provided on a powermaintenance panel of the magnetic disk apparatus with

a power ON/OFF switch which is operated manually at the time ofmaintenance work or performs the power input and cut-off through a powercontrol interface from a higher apparatus,

an R/L switch for switching between a side enabling input and cut-off ofpower from a remote location (REMOTE) and a side enabling input andcut-off of power locally (LOCAL), and

a display means for displaying the state of the R/L switch, wherein

during maintenance work of the magnetic disk apparatus, the R/L switchis turned to the "LOCAL" side, the power ON/OFF switch is used to cutoff the power, and, after the end of the maintenance work, the R/Lswitch is turned to the REMOTE side and the display means is made togive a display.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a view of the mounting structure of a magnetic disk apparatusaccording to the present invention,

FIG. 2 is a structural view of the back surface of the mountingstructure of FIG. 1.

FIG. 3 is a block diagram showing the system constitution of FIG. 1.

FIG. 4 is a block diagram of a circuit showing a power control system ofFIG. 1.

FIG. 5 is a block diagram of a circuit showing a power supply system ofFIG. 1.

FIG. 6 is an explanatory view showing the mounting structure of FIG. 1and FIG. 2 taken out of the locker and spread out.

FIG. 7 is a view of the mounting structure of an example of theconventional magnetic disk apparatus.

FIG. 8 is a basic structural view of a back-up for power failureaccording to the present invention.

FIG. 9 is a block diagram of a circuit of an embodiment showing thepower supply system of FIG. 8,

FIG. 10 is a block diagram of a circuit of an embodiment of a batteryunit of FIG. 8.

FIG. 11 is a timing chart showing the timing of judgement of thecharging completion notification signal at the time of a power failurein FIG. 9.

FIG. 12 is a flow chart showing the power control routine in FIG. 9.

FIG. 13 is a flow chart having as a subroutine the power failuremonitoring processing in FIG. 9.

FIG. 14 is a block diagram of a circuit of another example showing thepower supply system of FIG. 8.

FIG. 15 is a timing chart showing the timing of judgement of thecharging completion notification signal at the time of a power failurein FIG. 14.

FIG. 16 is a flow chart showing the power control routine in FIG. 14.

FIG. 17 is a structural view of an example of a conventional magneticdisk apparatus housing a battery unit.

FIG. 18 is a timing chart of the charging completion notification signalissued mistakenly at the time of a power failure in the prior art.

FIG. 19 is a basic structural view of back-up control according to thepresent invention.

FIG. 20 is a block diagram of a circuit of an example showing the powersupply system in FIG. 19.

FIG. 21 is a flow chart showing the back-up control in FIG. 19.

FIG. 22 is a basic structural view of a conventional magnetic diskapparatus.

FIG. 23 is basic structural view of a conventional back-up control.

FIG. 24 is an explanatory view of the principle of activation control ofa magnetic disk apparatus according to the present invention.

FIG. 25 is a timing chart of an embodiment of activation controlaccording to FIG. 24.

FIG. 26 is a timing chart of another embodiment of activation control ofFIG. 24.

FIG. 27 is a timing chart of another embodiment of activation controlaccording to FIG. 24.

FIG. 28 is a timing chart of another embodiment of the method ofactivation according to FIG. 24.

FIG. 29 is a flow chart of activation control of FIG. 24.

FIG. 30 is an explanatory view of the activation time and changes incurrent per unit of a magnetic disk module.

FIG. 31 is a timing chart of an example of conventional activationcontrol.

FIG. 32 is a timing chart of another example of conventional activationcontrol.

FIG. 33 is a basic structural view of monitoring of power according tothe present invention.

FIG. 34 is a timing chart of battery patrol in FIG. 33.

FIG. 35 is a timing chart of battery monitoring and system incorporationin FIG. 33.

FIG. 36 is a timing chart of the battery patrol at the time ofcompetition in FIG. 33.

FIG. 37 is a flow chart (1) of the processing routine in FIG. 33.

FIG. 38 is a flow chart (2) of the processing routine in FIG. 33.

FIG. 39 is a flow chart (3) of the processing routine in FIG. 33.

FIG. 40 is a basic structural view of the power unit of the magneticdisk apparatus.

FIG. 41 is a timing chart of the conventional battery monitoring andsystem incorporation.

FIG. 42 is a basic structural view of power cut-off control according tothe present invention.

FIG. 43 is a circuit diagram of an embodiment of a cross control circuitof the structure of FIG. 42.

FIG. 44 is a flow chart of the start of a battery test in FIG. 42.

FIG. 45 is a structural view of conventional power cut-off control.

FIG. 46 is a basic structural view of the analysis of the causes ofpower cut-off according to the present invention.

FIG. 47 is a flow chart of processing of power cut-off in FIG. 46.

FIG. 48 is a basic structural view of the conventional analysis ofcauses of power cut-off.

FIG. 49 is a flow chart of the processing for power cut-off in FIG. 48.

FIG. 50 is a basic structural view of a power maintenance display panelaccording to the present invention.

FIG. 51 is a flow chart of the processing of maintenance work in FIG.50.

FIG. 52 is a basic structural view of a magnetic disk control apparatus.

FIG. 53 is a basic structural view of the area around a power supply inFIG. 52.

FIG. 54 is a basic structural view of a conventional power maintenancedisplay panel.

FIG. 55 is a flow chart of the processing of maintenance work in FIG.54.

FIG. 56 is a perspective view of the exterior of a magnetic diskapparatus to which the present invention is applied.

BEST MODE FOR CARRYING OUT THE INVENTION

First, an explanation will be made of the structure of a magnetic diskapparatus according to the present invention. Before explaining thepresent invention, however, the conventional structure and problems inthe same will be explained in accordance with the drawings.

FIG. 7 is a structural view of an example of a conventional magneticdisk apparatus. The figure shows the locker mounting structure in atransparent state. In the figure, 100 is a locker of a magnetic diskapparatus, in which locker 100 for example 16 magnetic disk modules 102are plugged in on a circuit board 106. The magnetic disk modules 102house AC-DC converters 104, which receive the supply of commercial powerof AC 100V from a module-use NFB108 and generate the DC ±5V and DC ±12Vnecessary for the drive of the magnetic disk modules 102.

The magnetic disk modules 102 are attached to the circuit board 106 by adetachable plug-in system to enable exchange in the event of abreakdown. The power is supplied to the AD-DC converters 104 built inthem, however, by cable connection.

On the other hand, the magnetic disk control apparatuses for controllingthe 16 magnetic disk modules have the magnetic disk modules 102 disposedunder their control in units of eight. Therefore, two magnetic diskcontrol apparatuses are accommodated in separate lockers (not shown).Two AC-DC converters 112 for supplying power to the magnetic diskcontrol apparatuses of the separate lockers are provided in the locker100 as shown in the figure. These receive the supply of AC 100V from thecontrol-use NFB114, create a prescribed DC voltage, and supply the sameto the magnetic disk control apparatuses using power cables. Note that116 is an interface holding box for connecting the 16 magnetic diskmodules 102.

On the other hand, there is a strong market demand for greatercompactness of the magnetic disk modules and for greater density, thatis, increasing the number of units mounted in a locker along with this.

As a factor inhibiting a greater density, there is the attempt toachieve greater compactness by mounting the magnetic disk controlapparatuses, which had been stored in separate lockers as mentionedearlier, in the same locker as the magnetic disk modules and, as aresult, the increase in the amount of cables used for supplying power tothe magnetic disk modules and the magnetic disk control apparatuses fromthe power units. This therefore becomes a factor inhibiting higherdensity mounting.

Further, as mentioned earlier, in general, ordinary commercial power isnot used for the power of large-sized computer systems, but exclusivepower facilities are provided. These power facilities have back-upbattery units and emergency generators. The large-sized computer systemsthemselves are not provided with back-up batteries. Further, lockerstorage types of magnetic disk apparatuses are used as subsystems oflarge-sized computer systems, but receive in common power from externalpower facilities. Accordingly, back-up power supplies are provided atthe outside.

Medium-sized computer systems used for offices etc., however, are notprovided with external power facilities such as with large-sizedcomputer systems, but are made to operate with ordinary commercialpower. Accordingly, back-up by external power facilities is notpossible. On the other hand, in recent years, even in such medium-sizedcomputer systems, locker storage type magnetic disk apparatuses havebeen used as subsystems in the same way as with large-sized systems and,consequently, it is necessary to mount back-up power supplies in thelockers of the magnetic disk apparatuses.

Accordingly, the amount of power cables used is increased due to thehousing of the battery units in the lockers and this becomes a furtherfactor inhibiting greater density.

In summary, it is necessary to house the magnetic disk controlapparatuses and house back-up batteries in a locker type magnetic diskapparatus used as a subsystem of a medium-sized computer system.Therefore, the amount of the power cables used increases, which becomesa factor inhibiting the greater density due to the increase of thenumber of units accompanying the greater compactness of magnetic diskmodules.

FIG. 1 is a structural view of an example of a magnetic disk apparatusaccording to the present invention. This figure shows a locker typemagnetic disk apparatus in a transparent state. As shown in the figure,the magnetic disk apparatus of the present invention is comprised of alocker 150 in which are housed a plurality of magnetic disk modules148-1 to 148-8, a plurality of power units (AC/DC converters) 112-1 to112-4 converting AC input voltage to a predetermined DC voltage andsupplying the same to the magnetic disk modules 148, and a magnetic diskcontrol apparatus 152. Two power units 112-1 and 112-2 are connected toa power mother board 160-1, while two power units 112-3 and 112-4 areplugged into a power mother board 160-2. Further, the mother boards160-1 and 160-2 have connected to them back-up battery units 114-1 to114-12. To one side of these batteries and mother board 160-1 and 160-2are connected the power units 112-1 to 112-4, while to the other sideare connected the back-up battery units 114-1 to 114-12. The power units112 and the battery units 114 are connected to the mother boards 160 bya detachable plug-in system.

When providing a plurality of mother boards 160-1 and 160-2, power linesbetween them are commonly connected to make a common power supply.

Further, the magnetic disk modules 148-1 to 148-8 are provided withDC-DC converters 116-1 to 116-4 for converting DC input voltage from thepower units 112-1 to 112-4 to a predetermined DC output voltage for thesupply of power.

These magnetic disk modules 148, power units 112, mother boards 160, anda magnetic disk control apparatus 152 are mounted in a single locker.

In this case, the magnetic disk modules 148 and the magnetic diskcontrol apparatus 152 are provided with DC/DC converters 116 whichreceive the same DC input voltage and output their own DC voltage.

In such a construction, by connecting a plurality of power units 112 bya mother board 160, it is possible to make common use of the power units112 and therefore to duplex the power. Further, by connecting thebattery units 114 to the mother board 160, it becomes possible to backup power at the time of a breakdown of the power supply or a powerfailure.

Further, the power units 112 output the same DC power as the batteryunits 114, so the same power lines can be used and the number of cablescan be slashed. At the same time, compared with supplying high voltageAC power, by supplying low voltage DC power, it becomes possible to usecables with low insulation resistances and possible to slash the cablespace.

Further, by connecting the power units 112 by the plug-in system, it ispossible to easily change or increase the number of units. Similarly, byconnecting the battery units 114 by the plug-in system, it is possibleto easily change or increase the number of units.

Also, by housing DC/DC converters 116 supplying the same input voltagein the magnetic disk control apparatus 152 and magnetic disk modules148, a single power line from the power units 112 is enough, the cablespace can be drastically reduced, and the cable connection work can beimproved.

In FIG. 1, the locker 150 constituting the housing of the magnetic diskapparatus, in this example, has eight magnetic disk modules 148-1 to148-8 mounted in it. As shown in the figure, four each are disposed intwo rows. Further, the control mother board 154 has a magnetic diskcontrol apparatus 152 mounted to it. In the magnetic disk controlapparatus 152, as mentioned later, are housed two directors and a commoncache memory. On the opposite side of the control mother board 154 aremounted the DC/DC converters 116-1 to 116-4. On the two sides of theDC/DC converters 116 are provided control panels 124-1 to 124-2corresponding to the two systems of power control.

On the power mother board 160-1 are mounted two AC/DC converters 112-1to 112-2. Further, on the power mother board 160-2 are mounted two AC/DCconverters 112-3 to 112-4. On the opposite side of the power motherboard 160-1 are mounted five back-up units 114-1 and 114-5 to 114-8,while on the opposite side of the power mother board 160-2 are mountedthe five battery units 114-3 and 114-7 to 114-12.

At the bottom of the locker 150 are installed a breaker housing box 134,an interface housing box 156, and an AC power lead-in box 158.

FIG. 2 is an explanatory view showing the locker mounting structure ofFIG. 1 from the back side in a transparent state in the same way.

In FIG. 2, it is seen that four magnetic disk modules 148-1 to 148-4 and148-5 to 148-8 each are mounted with respect to the two drive motherboards 162-1 and 162-2 set at the rear side. Further, at the rear sideof the power mother boards 160-1 and 160-2, five battery units 114-1 and114-5 to 114-8 and battery units 114-9 to 114-12 each are mounted.

The AC-DC converters 112-1 to 112-4 and battery units 114-1 to 114-12for the power mother boards 160-1 and 160-2 shown in FIG. 1 and FIG. 2are attached detachably by a plug-in structure.

FIG. 3 is a block diagram of a circuit showing a subsystem of a computersystem using the magnetic disk apparatus of the present invention.

In FIG. 3, 136 is a channel processor which has four channels 138-1 to138-4.

In the locker of the magnetic disk apparatus are provided directors118-1 and 118-2, which function as the magnetic disk controlapparatuses. These are connected to the channels 138-1 to 138-4 by BMCboards 142-1 to 142-4 through a BMC interface (block multiplexer channelinterface) 140.

String controllers 144-1 and 144-2 are provided with respect to thedirectors 118-1 and 118-2, from which string controllers 144-1 and 144-2are led out, for example, a total of four systems of buses, two for eachsystem, by a device interface 146.

Further, in the embodiment of FIG. 1, eight magnetic disk modules 148-1to 148-8 are mounted. The remaining magnetic disk modules 148-9 to148-16 are mounted in a separate locker as a further addition.

The channel processor 136 is connected as a subsystem to the channels ofa main storage control apparatus (MSC) of a computer system providedwith a CPU, main storage control apparatus, and main storage unit (MSU).

FIG. 4 is a block diagram of a circuit showing a power control system inthe embodiment of FIG. 1 and FIG. 2.

In FIG. 4, a first power control unit 180-1 and a second power controlunit 180-2 are provided in the magnetic disk control apparatus 152 ofFIG. 1. Further, a first drive unit 182-1 is provided corresponding tothe four magnetic disk modules 148-1 to 148-4 and a second drive unit182-2 is provided corresponding to the magnetic disk modules 148-5 to148-8.

In the first power control unit 180-2, a power controller 110-1 isprovided, which controls the input and cut-off of power to the differentcomponents. The power controller 110-1 has connected to it through ahigher interface 122-1 by a terminal 128-1, for example, an outsideservice processor (SVP) etc., which service processor gives a powerinput command which when received starts the control of the input ofpower of the apparatus as a whole.

The power controller 110-1 also is provided with a maintenance panel124-1, which is provided with switches for manually inputting or cuttingoff power units under the control of the power controller 110-1 and a7-segment display which shows the alarm state of the power units.

The control lines from the power controller 110-1 are allocatedindividually to the director 118-1, DC-DC converters 116-1 and 116-2,AC-DC converter 112-1, and battery units 114-1 and 114-2. Furthercontrol lines from the power controller 110-1 to the battery units 114-1and 114-2 are laid through an interface controller 126-1.

The construction of the second power control unit 180-2 side is thesame.

The battery units 114-5 to 114-8 and the DC-DC converters 116-5 to 116-8provided at the first drive unit 182-1 are given control lines of twosystems from the power controllers 110-1 and 110-2.

The battery units 114-9 to 114-12 and the DC-DC converters 116-9 to116-12 provided at the second drive unit 182-2 are given control linesof two systems from the power controllers 110-1 and 110-2.

Further, the AC-DC converters 112-3 and 112-4 provided at the seconddrive unit 182-2 are also given control lines of two systems from thepower controllers 110-1 and 110-2.

Therefore, the power controller 110-1 controls the units provided at thefirst drive unit 182-1 and the AC-DC converter 112-3 provided at thesecond drive unit 182-2, while the power controller 110-2 controls theunits other than the AC-DC converter 112-3 provided at the second driveunit 182-2.

In this way, the components controlled by the power controllers 110-1and 110-2 are determined in advance, but if either breaks down, thenormal side places all of the power units under its control and controlsthe input or cut-off of power for the same, thereby achieving duplexcontrol.

The common cache memory 120 is excluded from the scope of the control ofpower by the power controllers 110-1 and 110-2.

FIG. 5 is a block diagram of a circuit showing the power supply systemin the embodiment of FIG. 1 taken out.

In FIG. 5, the power supply system is divided into the power controlunit 152 and the first and second drive units 182-1 and 182-2.

The power supply system in the power control unit 152 is providedsymmetrically with respect to the common cache memory. For example,looking at the top of the common cache memory 120, the AC input from theAC input terminal 130-1 is input through a noise filter 132-1 and abreaker 134-1 to the AC-DC converter 112-1, which for example outputs DC29V.

The AC-DC converter 112-1 supplies power to the power controller 110-1to enable an ordinary operating state. Further, the DC 29V output of theAC-DC converter 112-1 is converted by the DC-DC converter 116-1 to forexample DC ±5V and ±12V, which are supplied to the director 118-1.Further, this is converted to the same DC ±5V and DC ±12V at the DC-DCconverter 116-1 and supplied to the common cache memory 120.

At the bottom side of the common cache memory 120 as well, similarly theAC input from the AC input terminal 130-2 is converted through the noisefilter 132-2 and breaker 134-2 by the AC-DC converter 112-2 to DC 29V.This is converted to the predetermined DC voltage by the DC converters116-3 and 116-2, then the power is supplied to the director 118-2 andthe common cache memory 120.

Further, DC voltage is supplied to the power controller 110-2 by theAC-DC converter 112-2.

At the power lines of the AC-DC converters 112-1 and 112-2 are connectedthe battery units 114-1, 114-2 and 114-3, 114-4. The battery units 114-1to 114-4 receive a supply of DC 29V from the AC-DC converters 112-1 and112-2 in the normal state, so their internal cells are in a chargedstate. When the AC input is cut by a power failure or momentary powercut-off, they supply the same DC 29V as the AC-DC converters 112-1 and112-2 to the DC-DC converters 116-1 to 116-3 so as to back up thedirectors 118-1 and 118-2 and the common cache memory 120.

On the other hand, the drive unit 182-1 is provided with the DC-DCconverters 116-5 to 116-8. These receive in common DC 29V from the twoAC-DC converters 112-1 and 112-2 provided at the power control unit 152and supply DC ±5V and DC ±12V to the corresponding disk enclosures 136-1to 136-4.

Here, the DC-DC converters 116-5 to 116-8 and the disk enclosures 136-1to 136-4 are housed in the magnetic disk modules 148-1 to 148-4 shown inFIG. 3.

Further, the first drive unit 182-1 is provided with battery units 114-5to 114-8 which are commonly connected to power lines from the AC-DCconverters 112-1 and 112-2 and supply for example DC 24V in the event ofa failure or momentary cut of the AC input so as to back up theconverters 116-5 to 116-8.

The second drive unit 182-2 supplies the AC input from the AC inputterminal 130-3 through the noise filter 132-3 and further through thebreakers 134-3 and 134-4, which are divided into two systems, to theAC-DC converters 112-3 and 112-4. The AC-DC converters 112-3 and 112-4convert the AC 100V input to DC 29V and supply the same as common powerto the DC-DC converters 116-9 to 116-12.

The DC-DC converters 116-9 to 116-112 supply DC ±5V and DC ±12V to thedisk enclosures 136-5 to 136-8. Further, the output lines of the AC-DCconverters 112-3 and 112-4 have the battery units 112-9 to 112-2commonly connected to them, which can provide back-up in the event of apower failure or momentary power cut.

Further, in the mounting structure of FIG. 1 and FIG. 2, the batteryunits 114-2 and 114-4 provided at the power control unit 152 of FIG. 5are not mounted. The example is shown of the case of mounting theremaining 10 battery units.

FIG. 6 is an explanatory view showing the mounting structure shown inFIG. 1 and FIG. 2 taken out and spread open. The spread out view of FIG.6 corresponds to the block diagram of the circuit of the power supplysystem shown in FIG. 5 and clarifies the state of connection of theunits to the mother boards and the state of connection of the cablesbetween the mother boards and the units.

In FIG. 6, the power mother boards 160-1 and 160-2 have plugged intothem the AC-DC converters 112-1, 112-3, and 112-2, 112-4. The plugged-instate is realized by plugging in the connectors 66 attached to the unitsto the connectors 164 of the boards.

At the surface of the opposite side of the power mother boards 160-1 and160-2 are plugged in the battery units 114-1, 114-5 to 114-8 and 114-3,114-9 to 114-12 by the plug-in construction using the connectors 164 and166.

Further, the drive mother boards 162-1 and 162-2 have plugged into them,respectively, the magnetic disk modules 148-1 to 148-4 and 148-5 to148-8. Further, the magnetic disk modules 148-1 to 148-8 house the DC-DCconverters 116-5 to 116-12.

Further, the control mother board 54 has plugged into it four DC-DCconverters 116-5 to 116-12.

The power mother boards 160-1 and 160-2 are connected by the powercables 170-1 and 170-2 to make common use of the power as shown in thepower system diagram of FIG. 5. Further, the mother board 160-1 and thedrive mother board 162-1 are connected by the power cable 172-1.Similarly, the power mother board 160-2 and drive mother board 162-2 areconnected by the power cable 172-2. At this portion as well, common useis made of the power as shown by the power system diagram of FIG. 5.

Further, the DC-DC converters 116-1, 116-2 and 116-3, 116-4 are suppliedwith power by the power cables 170-3 and 170-4 individually from thepower mother boards 160-1 and 160-2.

As explained above, according to the construction of the magnetic diskapparatus according to the present invention, by connecting a pluralityof power units to the mother boards, it is possible to make common useof a plurality of power units without the need for power cables and itis possible to reduce the amount of power cables used and thereforerealize a higher density of mounting in the apparatus.

Further, by mounting the battery units at the back side of the motherboards on which the power units are mounted, it is possible to realizeback-up at the time of breakdown of the power supply or power failureand it is possible to realize a higher density of mounting since thebattery units as well need not be connected by cables.

Also, by making the construction one which the power units and batteryunits are detachably plugged in, it is possible to suitably set thepower capacity required for additional installation of magnetic diskmodules.

Further, by providing DC-DC converters at the magnetic disk controlapparatus and the magnetic disk modules and performing the conversion tothe required DC voltage at the same, it is possible to make the DCvoltage supplied from the power units provided at the mother boards thesame voltage and therefore connection by a single power cable issufficient, so the amount of the power cables used can be furtherreduced.

Next, an explanation will be made of the back-up by the battery units atthe time of a power failure according to the present invention. Beforeexplaining the present invention, the conventional system and itsproblems will be described.

FIG. 17 is a structural view of key portions of a magnetic diskapparatus housing a battery unit.

In FIG. 17, 212 is an AC-DC converter which functions as a power unit.This receives as input AC 100V and converts it, for example, to DC 29V.The power from the AC-DC converter 212 is supplied to a director 218,which functions as a magnetic disk control apparatus, and the magneticdisk module connected under the control of the director 218.

Further, the director 218 and the magnetic disk module 248 accommodateDC-DC converters 216 which produce the DC voltage required for the same.Several magnetic disk modules 248 are actually installed, but for thepurpose of simplification of the explanation, only one is shown.

The power line from the AC-DC converter 212 has connected to it abattery unit 214. In the battery unit 214 is provided a circuit whichdetects when the charging is completed and outputs a charging completionnotification signal when the charging current falls below apredetermined value.

The battery unit 214 is charged with DC 29V from the AC-DC converter212. If a power failure occurs in the state where the charging of theunit has been completed, it is possible to guarantee the supply of powerover a guaranteed back-up time T₁ determined by the battery capacity.

The power controller 210 receives instructions from a higher apparatusto control the input and cut-off of power. When a power failure isdetected, further, the director 214 ends the I/O processing of themagnetic disk module 248 within the back-up time T₁ guaranteed by thebattery unit 218, then stops the operation of the AC-DC converter 212and the DC-DC converters 216 and cuts the power.

However, in a magnetic disk apparatus provided with such a power back-upfunction, there is the problem that if a power failure occurs in thestate before the charging of the battery unit is completed, a mistakencharging completion notification signal is sent due to the power failureand the power back-up time is not guaranteed, yet back-up processing thesame as at the time of the completion of the charging ends up beingperformed.

FIG. 18 is an explanatory view of the problems in the prior art. Thesewill be explained below in more detail referring to FIG. 18. If a powerfailure occurs at a time t₀ when the charging of the battery unit 214 isnot completed and the charging completion signal is the L level, thepower voltage Vcc starts to gradually fall. The completion of chargingof the battery unit 212 is detected when the charging current fallsbelow a predetermined value. When the power voltage Vcc falls to Vref₁along with a power failure, at the time t₀, the charging current alsofalls below a prescribed value, the completion of charging is mistakenlydetected at the time t₁, and the charging completion notification signalto the power controller 210 is made the H level.

Next, at the time t₂, the power controller 210 detects a power failureby the power voltage Vcc falling below the reference voltage Vref₂.

If the power controller 210 detects a power failure at the time t₂, itreads in the charging completion notification signal obtained at thattime and judges if the charging has been completed. In this case, thecharging has actually not yet been completed, but since the chargingcompletion notification signal is at the H level showing completion, itis judged that the charging has been completed, the director 218 isinstructed to continue the normal I/O processing over the guaranteedback-up time T₁, then end the I/O processing for the power cut-off, aresponse is awaited, then the power is cut.

The battery unit 214, however, is insufficiently charged and the powervoltage from the battery unit 214 falls below the operating level of thedirector 218 and the magnetic disk module 248 during the power back-uptime T₁, so there is the problem that the subsystem stops and thereforethe computer system is abnormally ended or data is destroyed.

The present invention was made in consideration of this problem in theprior art and has as its object to enable power to be suitably cut offwithout causing the system to abnormally end or data to be destroyedeven if a power failure occurs before the completion of the charging ofthe battery.

FIG. 8 is a basic explanatory view of the back-up by the battery at thetime of a power failure according to the present invention.

First, the magnetic disk apparatus to which the present invention isapplied is provided with a magnetic disk module 248 connected under thecontrol of a magnetic disk control apparatus (director) 218, a powerunit (AC-DC converter) 212 for converting an input voltage from anexternal power supply to a predetermined DC voltage and then supplyingthe same to the magnetic disk module 248, a battery unit 214 forsupplying a DC voltage the same as the power unit 212 to the disk module248 at the time of a power failure, and a power control means (powercontroller 210) for controlling the input and cut-off of power to thepower unit 212 and the magnetic disk module 248.

In this magnetic disk apparatus, in the present invention, first, thebattery unit 214 is provided with a charging completion detecting means2112 for judging if the charging of the built-in cells has beencompleted and outputting a charging completion notification signal tothe power control means 210 when the charging current falls below apredetermined value. Further, the power control means 210 is providedwith a charging completion invalidating means which invalidates acharging completion detection signal output from the charging completiondetecting means at the time of detection of a power failure and enablesjudgement as to if charging has not yet been completed at a time ofdetection of a power failure when a charging completion notificationsignal is output while the charging current is falling due to a powerfailure which occurs before the completion of charging.

Further, provision is made of a delay means (counter) 268 for delayingthe charging completion notification signal from the charging completiondetecting means 2112 by a predetermined time and then supplying the sameto the power control means 210. When a charging completion notificationsignal is output due to the fall of the charging current due to a powerfailure occurring before the completion of charging of the battery unit214, the charging completion notification signal is made to be receivedafter the time of detection of the power failure by the power controlmeans 210 at the delay caused by the delaying means 286 and thus it ismade possible to detect that the charging has not yet been completed atthe time of detection of the power failure.

Further, instead of the delay means 2112, provision may be made in thepower control means 210 of a charging completion judging means forreading in and holding the charging completion notification signal everypredetermined period, reading out the charging completion detectionsignal detected a predetermined time before at the time of detection ofa power failure, and thereby judging the completion of the charging.

Using this charging completion judging means as well, it is possible tojudge if the charging has not yet been completed at the timing ofdetection of a power failure when a charging completion notificationsignal is output due to a fall in the charging current caused by a powerfailure before the completion of charging by the battery unit 214.

Here, the power control means 210, when judging that the charging hasbeen completed at the timing of detection of a failure, instructs thedisk control means 218 to disconnect the magnetic disk module 248 aftera predetermined back-up time T₁ elapses and stops the supply of power bythe power unit 212 when receiving a cut-off authorization response fromthe magnetic disk control means 218.

Further, when judging that the charging has not yet been completed atthe time of detection of a power failure, it does not wait for theelapse of the predetermined back-up time T₁, but immediately instructsthe disk control means 218 to disconnect the magnetic disk module 248and stops the supply of power by the power unit 212 when receiving acut-off authorization response from the magnetic disk control means 218.

Also, when not receiving a cut-off authorization response from themagnetic disk control means 218 even after the elapse of a predeterminedtime T₂ from when a request for cut-off is made, it stops the supply ofpower by the power unit 212 without receiving cut-off authorization.

According to a magnetic disk apparatus of the present invention providedwith such a construction, even if a power failure occurs before thecompletion of charging of the battery unit 214, completion of chargingis mistakenly detected due to the fall in the charging currentaccompanying the power failure, and a charging completion notificationsignal is output, this is sent to the power control means 210 afterbeing delayed by a predetermined time by the delay means 286.

Therefore, even if a power failure is detected by the power controlmeans 210 after the charging completion notification signal is sent, thecharging completion notification signal still shows that the charginghas not yet been completed at this time and therefore it is possible tojudge that the charging has not yet been completed, which shows theactual charging state, at the time of detection of a power failure.

Accordingly, disconnection of the magnetic disk module 248 is instructedto the magnetic disk control means 218 immediately without continuingthe normal I/O operation over a predetermined back-up time T₁.Therefore, receipt of a new I/O request by the magnetic disk module 248is prohibited. When the I/O processing currently being performed orreceived ends, the disconnection is performed and cut-off authorizationis notified to the power control means 210.

Based on this cut-off authorization response, the power control means210 cuts the supply of power to the magnetic disk module 248 and stopsthe subsystem.

Therefore, even if a mistaken charging completion signal is sent due toa power failure, it is judged that the charging has not yet beencompleted, the I/O processing is immediately ended and the power cut,and therefore it is possible to reliably prevent an abnormal ending ofthe system and destruction of data at the time of a power failure.

FIG. 9 shows the power supply system and control system in the magneticdisk apparatus of the present invention shown in FIG. 4 and FIG. 5 takenout at the power controller 110-1 (210-1) side. For simplification ofthe explanation, only the AC-DC converter 212-1 (112-1), the DC-DCconverter 216-5 (116-5), and the battery unit 214-5 (114-5) are takenout and shown.

In FIG. 9, a microprocessor 260 is provided in the power controller210-1, which in turn is provided with, by program control, a first timer275-1 which measures a back-up time T₁ during which a normal I/Oprocessing is guaranteed at the time of a power failure and a secondtimer 275-2 for monitoring a disconnection processing time T₂ after theelapse of a back-up time T₁.

Connected to the internal bus 262 from the microprocessor 260 are a RAM264, a ROM 266, an interface unit 268 to another power controller 210-2,a director interface unit 270 to the director 218-1, a panel interfaceunit 272 to a maintenance panel 224-1, a host interface unit 274 to aservice processor of a host computer, a disk interface unit 276 to amagnetic disk module 248-1, a converter interface unit 278 to an AC-DCconverter 212-1 and a DC-DC converter 216-5, and a battery interfaceunit 284 to a battery unit 214-5.

A charging control signal E₁ and battery test signal E₂ are output fromthe battery interface unit 284 to the battery unit 214-5. Further, acharging completion notification signal E₃ and a battery abnormalitynotification signal E₄ are output from the battery unit 214-5.

Here, the charging completion notification signal E₃ from the batteryunit 214-5 is input to the counter 286 used as the delay means. Thecount operation is started from the time of input. After a predeterminedtime, the delayed charging completion notification signal E₃₀ is outputfrom the battery interface unit 284.

FIG. 10 is a circuit diagram showing an embodiment of the battery unit214-5 of FIG. 9.

In FIG. 10, the positive and negative terminals 288-1 and 288-2 areconnected to the power line from the AC-DC converter 212-1 and receiveDC 29V. The input DC 29V is supplied through the charging currentdetection circuit 290, the stabilization circuit 292, the diode 294, andthe breaker 296 to the battery 298, whereby the battery 298 is charged.

The stabilization circuit 292 holds the charging current to the battery298 constant and restricts the rush current at the time of the start ofthe charging. The charging current detection circuit 290 detects thecharging current to the battery 298. More specifically, it detects thevoltage corresponding to the charging current by passing the chargingcurrent through a resistor.

The detection signal of the charging current detection circuit 290 isgiven to a charging completion detection circuit 2112. This compares thedetected voltage corresponding to the charging current with apredetermined reference voltage Vref₁ and, when the detected voltagefalls below the reference voltage Vref₁, that is, when the chargingcurrent falls below a prescribed value, generates a charging completiondetection output and outputs the charging completion notification signalE₃ from the interface circuit 2110.

In parallel with the serial circuits of the charging current detectioncircuit 290, the stabilization circuit 292, and the diode 294 isconnected from the battery 298 side a circuit comprised of the chargingcontrol switch 2100 and diode 2102 connected in series. The chargingcontrol switch 2100 receives a discharge control signal E₁ for theinterface circuit 2110 and turns on and connects the plus side of thebattery 298 through the diode 2102 to the outside power line.

Therefore, if the discharge control switch 2100 is closed, even if theDC 29V from the AC-DC converter 212 is cut due to a power failure, thesame DC 29V charged in the battery 298 is supplied through the breaker296, discharge control switch 2100, and diode 2102 to the outside.

Further, a test switch 2104 and discharge resistors 2106 and 2108 areconnected in series in parallel with the battery 298. The test switch2104 is given a test signal E₂ through the interface circuit 2110 toturn the test switch 2104 on, whereby a discharge current flows from thebattery 298 to the discharge resistors 2106 and 2108 and a dischargetest of the battery 298 is performed. Further, at the time of adischarge test, the discharge control switch 2100 is turned off.

In a discharge test, if the battery 298 is abnormal, when a dischargecurrent is passed to the discharge resistors 2106 and 2108 over apredetermined time, the voltage of the battery 298 falls considerably.The voltage of the battery 298 is input to the battery abnormalitydetection circuit 2114 as a divided voltage of the discharge resistors2106 and 2108. The battery abnormality detection circuit 2114 detectsthat the battery is abnormal and outputs a battery abnormalitynotification signal E₄ when the detected voltage falls below apredetermined voltage at the time of a discharge test.

FIG. 11 is a timing chart showing the charging completion notificationsignal at the time when a power failure occurs before the completion ofcharging of the battery unit 214-5 in the power controller 210-1 and thetiming of detection of a power failure in the power controller 210-1.

In FIG. 11, assuming that a power failure occurs in a state where thecharging of the battery unit 214-5 has not been completed, that is, at atime t₀ where the charging completion notification signal E₃₀ obtainedthrough the counter 286 is at the L level, in the battery unit 214-5shown in FIG. 10, the input DC voltage falls due to the power failure inthe middle of charging of the battery 298, so the charging current fallsand the voltage detected by the charging current detection circuit 290falls. When the detected voltage of the charging current falls below thereference voltage Vref₁, the charging completion detection circuit 2112judges that the charging has been normally completed regardless of thefall of the detected voltage due to the power failure and outputs thecharging completion notification signal E₃ through the interface circuit2110.

However, the charging completion notification signal E₃ from the batteryunit 214-5 is input to the counter 286. At the counter 286, this isdelayed by exactly a predetermined time, for example, a predeterminedtime ΔT exceeding the time from when a power failure occurred at thetime t₀ in FIG. 11 to the time t₂ where the power failure is detected bythe power controller 210-1, then is input to the battery interface unit284 of the power controller 210-1.

For this reason, even if, at the time t₂, a microprocessor 260 providedat the power controller 210-1 detects a power failure through theconverter interface unit 278 when the DC output voltage of the AC-DCconverter 212-1 falls below the reference voltage Vref₂, since thecharging completion notification signal E₃₀ is at the L level, showingthat the charging has not yet been completed, at the time of detectionof the power failure, it is possible to judge that the charging of thebattery unit 214-5 has not yet been completed.

When it is judged that the charging of the battery unit 214-5 has notyet been completed, this instructs the disconnection of the magneticdisk module to the director 218-1 immediately without waiting for theelapse of the back-up time T₁ guaranteed in the state of completion ofcharging. The director 218-1 prohibits the receipt of new I/O requestsand disconnects the magnetic disk module awaiting the completion of theI/O processing already received, and sends back a cut-off authorizationresponse. Receiving this response, the power controller 210-1 stops theoperation of the AC-DC converter 212-1 and the DC-DC converter 216-5 andcuts the power of the director 218-1 and the magnetic disk module 248-1.

Further, in the embodiment of FIG. 9, the example was taken of the DC-DCconverter 216-5 and the battery unit 214-5 of the magnetic disk module248-1, but the same type of processing is performed for the othermagnetic disk modules 248-2 to 248-3 under the control of the powercontroller 210-1 and the power is cut off for the director 218-1 aswell.

Further, like with the power controller 210-1, the power controller110-2 of the other system shown in FIG. 4 and FIG. 5 is exactly thesame.

FIG. 12 is a flow chart showing the power control by the processor 260provided at the power controller 210-1 shown in FIG. 9.

In FIG. 12, first, at step S1, if it is judged that there is an inputcommand for the system power from a service processor or other higherapparatus, then at step S2 the count n is set to n=1 and the first unitamong the four DC-DC converters provided in the four magnetic diskmodules 248-1 to 248-4 is instructed to turn on. At step S4, it isjudged if the count n has reached n=4. If less than 4, then at step 5,the count is incremented by 1 and the power on procedure of step S3 isrepeated.

By this, the four DC-DC converters under the control of the powercontroller 210-1 are successively activated.

Next, at step S6, n is made 1, then at step S7, it is checked if thefirst battery unit designated by n=1 is mounted or not. If normallymounted, then at step S8, the first battery unit of n=1 set at step S6is instructed to turn on. By this power-on instruction, a dischargecontrol signal E₁ is sent to the corresponding battery unit, thedischarge control switch 2100 shown in FIG. 10 is turned on, and thebattery unit enters a dischargable state.

After this, the processing of step S10, step S7, and step S8 is repeateduntil the fourth battery unit is turned on at step S9.

Further, if the battery is not yet mounted at step S7, the routineproceeds to step S16, where an alarm processing is performed and, forexample, the system is made to stop.

When the four battery units are finished being turned on by theprocessing up to step S9, at step S1, a timer determining the batterytest period is activated. Next, at step S12, it is judged if the timerdetermining the battery test period has run out of time. If it has notyet run out of time, the power failure monitoring processing of step S14is repeated until the time runs out. If it is judged at step S12 thatthe time has run out, the routine proceeds to step S13, where thebattery test processing is performed.

In the battery test processing at step S13, at the same time the testswitch 2104 provided at the battery unit of FIG. 10 is turned on, thedischarge control switch 2100 is turned off, a discharge current ispassed to the discharge resistors 2106 and 2108 from the battery 298 fora predetermined time, and the divided voltage of the discharge resistors2106 and 2108 after the elapse of a predetermined time is judged by thebattery abnormality detection circuit 2114. When it is below apredetermined voltage, it is judged that the battery 298 is abnormal,and a battery abnormality notification signal E₄ is sent from theinterface circuit 2110 to the power controller 210-1.

The power failure monitoring processing at step S14 consists of theprocessing shown in the subroutine of FIG. 9.

In the flow chart of FIG. 13, first, at step S1, when the powercontroller 210-1 detects a power failure, the routine proceeds to stepS2, where the charging completion notification signal E₃₀ obtained fromthe counter 286 at this time is read. At step S3, the completion ofcharging is judged. If the charging is completed, the routine proceedsto step S4, where the first timer for counting the back-up time T₁ isactivated.

Next, at step S5, it is checked if there was a cut-off requestinstruction from the higher apparatus, then at step S6, it is checked ifthe first timer has run out of time.

When a power failure has occurred even at the higher system, the highersystem detects the power failure, the I/O request is continued to thesubsystem for a predetermined time, then a request for cut-off is made,so in this case the routine proceeds to step S7 without waiting for theelapse of the back-up time T₁ and a request for cut-off is sent to thedirector 218-1.

Further, even without a cut-off request instruction from the higherapparatus, if it is judged that the time has run out due to the elapseof a back-up time T₁ due to activation of the first timer at step S6,the routine proceeds to step S7, where a cut-off request is made to thedirector 218-1. Next, at step S8, a second timer for monitoring theprocessing time T₂ for the cut-off request is activated.

The director 218-1, receiving the cut-off request, prohibits the receiptof a new I/O request and makes the magnetic disk module end the I/Oprocessing currently being received. When the I/O processing of themagnetic disk module ends, the director 218-1 disconnects the magneticdisk module and creates a state where the power can be cut off, socut-off authorization is sent back to the power controller 210-1.

When it is judged at step S9 that cut-off authorization from thedirector 218-1 has been sent back, the routine proceeds to step S11,where the operation of the AC-DC converter and DC-DC converter under itscontrol is stopped and the power is cut off.

Further, when no cut-off authorization has been sent back by thedirector 218-1 at step S9, there is an abnormality in the magnetic diskmodule. In this case, at step S10, it is awaited until the set time T₂of the second timer runs out, then the power is cut off at step S11.

FIG. 14 is a structural view of another embodiment of the presentinvention. In the embodiment of FIG. 9, the charging completionnotification signal E₃ from the battery unit 214-5 was delayed bypassing it through a counter 286, but in the embodiment of FIG. 14, thecounter 286 is eliminated and the microprocessor 260 checks the chargingcompletion notification signal which was read in and held more than apredetermined time before and judges if the charging has been completed.

That is, the microprocessor 260 of the power controller 210-1 reads inthe charging completion notification signal E₃ from the battery unit214-5 every predetermined period shown by the arrow in FIG. 16 and holdsa plurality of periods worth-of the signal in the RAM 264.

If a power failure occurs at the time t₀ in this state, due to the fallof the power voltage Vcc caused by the power failure, the chargingcurrent from the battery unit 214-5 falls below a prescribed value. Onthe basis of this, the charging completion signal E₃ becomes the Hlevel.

Next, when the power voltage Vcc falls below the reference voltageVref₂, the power controller 210-1 detects that there has been a powerfailure. The charging completion notification signal E₃ at this timebecomes the H level as shown by the timing of the arrow 2118 to show thecompletion of charging, but in the present invention, the chargingcompletion notification signal E₃ detected a predetermined time before,for example, at the previous timing shown by the arrow 2116, is read outand judged, so the charging completion notification signal E₃ is at theL level and it is judged that the charging has not yet been completed.

FIG. 16 is a flow chart showing a subroutine of power failure monitoringprocessing by the microprocessor 260 provided at the power controller ofFIG. 14. If a power failure is detected at step S1, then the chargingcompletion notification signal held in the RAM 64 a predetermined timeor more before is read at step S2 and it is judged at step S3 if thecharging has been completed.

Therefore, even if a charging completion notification signal ismistakenly sent out from the battery unit before a power failure isdetected, as shown in FIG. 15, whether or not the charging has beencompleted is judged from the charging completion notification signaldetected one period before, so it is judged that the charging has notyet been completed, the back-up time T₁ due to the activation of thefirst timer is not awaited, and the routine proceeds to step S7, where acut-off request is immediately made to the director 281-1. A response ofcut-off authorization is awaited from the director 218-1 and then thepower is cut off.

As explained above, according to the back-up control for power failuresaccording to the present invention, even if a charging completion signalis sent out from the battery unit mistakenly at the time of a powerfailure, it is possible to obtain a grasp of the state of charging ofthe battery unit accurately at the power controller side and back-upprocessing is performed commensurate with the battery charging state, soit is possible to reliably prevent abnormal ending of a system ordestruction of data at the time of a power failure and to improve thereliability of the apparatus.

Next, an explanation will be made of the back-up control at the time ofstopping the input of power according to the present invention.

FIG. 22 shows an outline of the conventional magnetic disk subsystem. Amagnetic disk apparatus 3120 is provided at the higher apparatus 3110such as a host computer. In the magnetic disk apparatus 3120 areprovided a magnetic disk control unit 318 such as a director and amagnetic disk module 348. Usually, several magnetic disk modules 348 areconnected to a path from the magnetic disk control unit 318.

FIG. 23 is a structural view showing a conventional power back-upsystem. A large capacity battery apparatus 3150 is connected between ahigher apparatus 3110 and magnetic disk apparatus 3120 provided in acomputer center 3130 and a power distribution facility 3140 forinputting power. Even when the supply of power stops, it is possible tosupply power from the battery apparatus 3150 to the system.

As mentioned earlier, in such a conventional back-up system, a largecapacity battery apparatus is required independent from the apparatusesof the computer system, so extra installation space is required andthere are also cost disadvantages in backing up an AC power supply.

Further, the battery apparatus and the apparatuses on the system sideare independently constructed, so close interface between the two isdifficult. As a result, it is not possible to obtain a back-up systemwith a good efficiency.

That is, it is difficult to confirm the state between the batteryapparatus and the apparatuses on the system side, so the back-upoperation is continued regardless of if the system is in a state notrequiring back-up or the system operation is continued regardless of itthe battery apparatus has reached the limit of its back-up.

To resolve these problems, it is necessary to have the magnetic diskapparatus itself incorporate a back-up battery and to execute the I/Ooperation even when the input of power to the apparatuses has stopped,but in performing the back-up operation, it is necessary to solve thefollowing problems:

(1) To continue the back-up as much as possible from when the magneticdisk apparatus detects a power failure to when the processing at thehigher apparatus side is completed and to prevent unnecessaryconsumption of the battery, it is necessary to quickly stop the back-upoperation at the time when the system operation ends.

(2) To continue a certain extent of the back-up operation when themagnetic disk apparatus alone detects a power failure and a powerfailure of more than the allowable value occurs, it is necessary tocause the I/O processing which has already been received by the magneticdisk apparatus from the higher apparatus to end and write the data beingwritten on the magnetic disk until the end without suspending it midway.

(3) Even when the magnetic disk apparatus detects a power failure andthen some sort of abnormality occurs at the magnetic disk apparatus sideand I/O processing cannot be completed, when the back-up time exceeds anallowable value of the battery, it is necessary to forcibly stop theback-up operation to prevent excess battery consumption.

(4) When the magnetic disk apparatus detects a power failure and theinput power is restored during the back-up operation, it is necessary tostop the back-up operation and continue the operation of the apparatus.

The present invention has as its object to enable suitable back-upcontrol in the event of a suspension in the input of power when abattery unit is provided in the magnetic disk apparatus itself.

FIG. 19 is a basic explanatory view of the back-up control according tothe present invention.

First, the present invention relates to a magnetic disk apparatusprovided with a main power unit 300 provided with a power unit (AC-DCconverter) 312 which receives as input external power and converts it toa predetermined DC voltage and a battery unit 314 which is charged by aDC voltage of the power unit 312 and outputs the same DC voltage at thetime of a power failure, a magnetic disk module 348 which operatesreceiving the supply of power from the main power unit 300, a magneticdisk control unit (directory) 318 which receives the supply of powerfrom the main power unit 300 and controls the magnetic disk module 348,and a power control unit (power controller) 310 which controls the inputand cut-off of power from the main power unit 300 to the magnetic diskmodule 348 and magnetic disk control unit 318.

In the magnetic disk apparatus according to the present invention, thepower control unit 310 is provided with a power failure detecting means3102 for detecting the stopping of the input of external power, a firsttimer 3104 which activates at the time of detection of a power failureby the power failure detecting means 3102, monitors the stopping time ofthe input of power, and issues a timer output when this reaches apredetermined back-up time T₁, and a back-up control means 3100 forexecuting power cut-off processing of the magnetic disk module 348 andmagnetic disk control unit 318 based on a cut-off instruction when apower cut-off instruction is received from a higher apparatus before thetimer output of the first timer 3104 and executes a power cut-offprocessing of the magnetic disk module 348 and magnetic disk controlunit 318 when obtaining the timer output in the case where noinstruction for power cut-off is received from the higher apparatus.

Here, as the power cut-off processing of the magnetic disk module 348and the magnetic disk control unit 318 by the back-up control unit 3100,a power cut-off control signal is output to the magnetic disk controlapparatus 318 to make the I/O operation of the magnetic disk unit 348end, then, when a cut-off authorization notification signal is receivedfrom the magnetic disk control unit 318 as a result of the end of theI/O operation, the power of the magnetic disk unit 348 and magnetic diskcontrol unit 318 is cut.

More specifically, the power control unit 310 is provided with a secondtimer 3106 which is activated simultaneously with the output of thepower cut-off control signal from the back-up control unit 3100 to themagnetic disk control unit 318, monitors the end of the I/O operation ofthe magnetic disk module 348, and issues a timer output when it reachesa predetermined time (T₂). The back-up control means 3100 cuts the powerof the magnetic disk module 348 and the magnetic disk control unit 318based on a notification of power cut-off authorization received from themagnetic disk control apparatus 318 before the timer output of thesecond timer 3106. When not receiving a notification of power cut-offauthorization from the magnetic disk control apparatus 318, it cuts thepower of the magnetic disk module 348 and the magnetic disk control unit318 when obtaining the timer output of the second timer 348.

The back-up control means 3100, when detecting the restoration of theinput of the power after detection of a power failure, stops the back-upoperation by clearing the first timer 3104 and continues the operationof the apparatus.

Further, when detecting the restoration of the input of power after theactivation of the second timer 3106, it clears the second timer 3106,prohibits the cut-off operation based on the notification of powercut-off authorization from the disk control unit 318, and continues theoperation of the apparatus.

According to the magnetic disk apparatus of the present inventionprovided with this construction, the following actions (1) to (4) areobtained:

(1) The power control unit 310 of the magnetic disk apparatus starts thesupply of internal power by the battery unit 314 when a suspension ofthe input of power is detected in the power failure detecting means3102. Further, the magnetic disk control unit 318 and the magnetic diskmodule 348 continue the I/O operation with the higher apparatus.

The higher apparatus also continues the I/O processing while detectingpower failures by some means or another. When the time of cessation ofpower reaches a predetermined value, it ends the I/O processing to beexecuted and instructs the magnetic disk apparatus through the powercontrol interface to cut the power.

The power control unit 310 of the magnetic disk apparatus instructed tocut the power cuts the power to the magnetic disk control unit 318 andthe magnetic disk module 348 and stops the back-up operation by thebattery unit 314.

(2) When just the magnetic disk apparatus detects the cessation of theinput of power and there is no instruction from the higher apparatus tocut the power, the power control unit 310 of the magnetic disk apparatusactivates the first timer 3102 when a power failure is detected,monitors the back-up time, and requests a power cut-off to the magneticdisk control unit 318 at the time when the back-up time exceeds acertain time T₁.

The magnetic disk control unit 318, receiving the request for powercut-off, stops the receipt of new I/O processing from the higherapparatus, makes the I/O processing of the magnetic disk unit 348received up to then end, and sends back to the power control unit 310 apower cut-off authorization.

The power control unit 310, receiving the power cut-off authorization,stops the supply of power to the magnetic disk control unit 318 and themagnetic disk module 348 and stops the back-up operation by the battery314.

(3) The power control unit 310 had requested a power cut-off to themagnetic disk control apparatus 318, but when the I/O operation is notended or power cut-off authorization cannot be received due to someabnormality of the magnetic disk module 348, the power control unit 310monitors the response time by the second timer 3106 activated at thetime a cut-off is requested and forcibly cuts the supply of power to themagnetic disk control unit 318 and the magnetic disk module 348 when acertain time T₂ from the issuance of the power cut-off request isexceeded.

(4) The power control unit 310 of the magnetic disk apparatus, duringexecution of the back-up operation by the battery unit 314, makes theoperation of the apparatus continue by clearing the first timer 3104 andstopping its operation when restoration of the input of power isdetected in the power failure detecting means 3102 before the powercut-off instruction from the higher apparatus or before the first timerexceeds a predetermined time T₁.

FIG. 20 is a structural view of an embodiment of the present invention,which shows together the AC-DC converter 312-1 controlled by the powercontroller 110-1 shown in FIG. 4 and FIG. 5 and the magnetic disk module348-1 provided with the DC-DC converter 316-5 and disk enclosure 336-1.

In FIG. 20, the power controller 310-1, which serves as the powercontrol means, is provided with a microprocessor 360. The microprocessor360 is provided with a back-up control unit 3100, a power failuredetection unit 3102, a first timer 3104, and a second timer 3106realized by program control.

Connected to an internal bus 362 led out from the microprocessor 360 area RAM 364, a ROM 366, an interface unit to the other power controller310-2, a director interface unit 370 to a director 318-1 serving as themagnetic disk control unit, a panel interface unit 372 to themaintenance panel 324-1, a host interface unit 374 to a higher apparatussuch as a service processor (SVP), a disk interface unit 376 to amagnetic disk module 348-1, a converter interface unit 378 to the AC-DCconverter 312-1 and DC-DC converter 316-5, and a battery interface unit384 to the battery unit 314-5.

The back-up control at the time of a power failure by the back-upcontrol unit 3100, realized as a function of the microprocessor 360 ofthe power controller 310-1, is as shown in the flow chart of FIG. 21.

The back-up control of the present invention will be explained below inaccordance with the flow chart of FIG. 21.

(1) When receiving power cut-off instruction from host apparatus

If the AC input to the magnetic disk apparatus of the present inventionstops, when the power voltage taken in through the converter interfaceunit 378 falls to a prescribed voltage, a power failure is detected inthe power failure detection unit 3102 provided in the microprocessor 360as shown by step S1 in FIG. 21.

Here, when the AC input has stopped, the same DC 29V is output from thebattery unit 314-5, which is in a charged state after receipt of DC 29Vfrom the AC-DC converter 312-1 up to then, resulting in the back-upstate.

If a power failure is detected at step S1, the first timer 3104 isactivated at step S2 and it is monitored as to whether the time elapsedfrom the detection of the power failure reaches a predetermined back-uptime T₁ guaranteed on the basis of the capacity of the back-up unit314-5.

On the other hand, when a power failure occurs at the higher apparatusat the same time as a power failure of the magnetic disk apparatus, thehigher apparatus as well detects a power failure by some means oranother, continues the I/O processing, ends the I/O processing to beexecuted when the time of cessation of power reaches a predeterminedtime, and instructs the power controller 310-1 of the magnetic diskapparatus through the host interface unit 374 to cut the power.

The instruction from the higher apparatus requesting a power cut-off isjudged at step S3 of FIG. 21. If a cut-off request is received, theback-up control unit 3100 of the processor 360 proceeds to step S5 whereit sends out a power cut-off control signal to the director 318 torequest a cut-off and simultaneously at step S6 activates the secondtimer 3106.

The director 318-1, receiving the power cut-off request from the powercontroller 310-1, stops the receipt of new I/O processing from thehigher apparatus and makes the processing in the magnetic disk module348-1 for the I/O processing which had been received up to then end.When a notification of completion is received from the magnetic diskmodule 348-1, a power cut-off authorization is sent back and notified tothe back-up control unit 3100 of the processor 360 through the directorinterface unit 370 of the power controller 310-1.

The response of authorization from the director 318-1 is judged at stepS7, then the routine proceeds to step S9, where the operation of theAC-DC converter 312-1 and the DC-DC converter 316-5 housed in themagnetic disk module 348-1 is stopped through the converter interfaceunit 378 and the supply of power is cut off.

(2) When power failure occurs in only magnetic disk apparatus

In this case, there is no instruction to cut off the power from thehigher apparatus. Therefore, if a power failure is detected at step S1,the first timer 3104 is activated at step S2. When the fact that apredetermined back-up time T₁ has been reached and the time has run outis judged at step S4, the routine proceeds to step S5, where a requestfor a cut-off of power is made to the director 318-1, the receipt of newI/O processing from the higher apparatus is stopped, and the I/Oprocessing in the magnetic disk module 348-1 which had been received upto then is simultaneously made to end.

Further, after the cut-off request to the director 318-1 at step S5, thesecond timer 3106 is activated at step S6.

If the I/O processing at the director 318-1 side is normally completed,a power cut-off authorization response is given to the power controller310 from the director 318-1. When this authorization response is judgedat step S7, the operation of the AC-DC converter 312-1 and the DC-DCconverter 316-5 is stopped and the power is cut off at step S9.

(3) When a request for cut-off of power is made from the powercontroller 310 to the director 318-1, but due to some abnormality theI/O operation is not completed or a power cut-off authorization responsecannot be made

A request for cut-off of power is made to the director 318-1 at step S5at both of the above (1) and (2), but if the I/O operation is notcompleted or if a power cut-off authorization response cannot be madeeven if the I/O operation is completed due to some abnormality at thedirector 318-1 or the magnetic disk module 348-1, then the second timer3106 activated at step S6 monitors the authorization response time withrespect to the request for power cut-off made to the director 318-1. Ifit is judged at step S8 that a predetermined time T₂ has been reachedand the time has run out, then the routine proceeds to step S9 evenwithout a cut-off authorization response from the director 318-1, theoperation of the converters is stopped, and the power is cut off.

(4) When input of power is restored after a power failure

In the power controller 310 of the magnetic disk apparatus, whenrestoration of the input of power is detected by the power failuredetection unit 3102 during the back-up operation shown in the above (1)or (2) due to detection of a power failure and before receipt of ainstruction for a request for power cut-off or before the first timer3104 activated by the detection of a power failure reaches thepredetermined back-up time T₁, the first timer is cleared and theoperation is stopped so as to forcibly suspend the back-up control bythe back-up control unit 3100 and make the magnetic disk apparatuscontinue to operate.

Further, when restoration of input of power is detected by the powerfailure detection unit 3102 after a cut-off request is made to thedirector 318-1 at step S5 and the second timer 3106 is activated at stepS6 and before a response giving permission for power cut-off is receivedfrom the director 318-1 or before the second timer 3104 reaches apredetermined time T₂, the second timer 3106 is cleared and theoperation is stopped. Also, the operation of the converters is notstopped, but the operation of the apparatus is made to continue even ifa response giving permission for power cut-off is received from thedirector 318-1 after that.

This processing for stopping the back-up operation based on thedetection of restoration of power is executed forcibly by interruptionprocessing with respect to the flow chart of FIG. 21.

The embodiment of FIG. 20 shows as an example of the control load theAC-DC converter 312-1, the DC-DC converter 316-5, and the battery unit314-5, but in actuality, the same back-up control is performed withrespect to all units shown in FIG. 4 under the control of the powercontroller 310-1. The same applies to the power controller 310-2 side.

Further, in the embodiment of FIG. 20, the power failure detection unit3102, the first timer 3104, and the second timer 3106 are realized byprogram control of the microprocessor 360, but it is also possible toconnect specialized firmware to the internal bus 362 of themicroprocessor 360.

As explained above, according to the back-up control of the presentinvention, provision is made of a battery unit inside the magnetic diskapparatus, so a large capacity battery apparatus serving the computersystem as a whole becomes unnecessary, the installation space can betremendously reduced, and the cost of the battery can be held to theminimum necessary.

Further, the internal operation of the magnetic disk apparatus and thesystem operation are guaranteed as much as possible during powerfailures and, simultaneously, battery deterioration is prevented byholding down the back-up time, thereby realizing an efficient back-up ofpower.

Next, an explanation will be made of the method of activation of themagnetic disk system according to the present invention. Beforeexplaining the present invention, however, the conventional system andits problems will be explained.

In the past, the method of activation used for holding down the rushcurrent in a magnetic disk subsystem mounting a plurality of magneticdisk modules was to activate the modules successively one by one, butthis mean a longer start-up time until the completion of activation.Therefore, there is also a method of dividing the magnetic disk modulesinto groups of several units and successively activating the groups.

Assume now that there are 16 magnetic disk modules mounted and, as shownin FIG. 30, the disk activation current per unit is 2A, a 30-secondactivation time is required, and the steady current after completion ofactivation is 0.5A.

FIG. 31 is a time chart showing the conventional method of activation bygrouping and the total current.

First, the 16 magnetic disk modules are divided into groups #1 to #4 offour units each. After the four units of the first group #1 areactivated, the succeeding groups #2 to #4 are activated successivelyeach time a predetermined time ΔT, ΔT=2 seconds, where the rush currentbecomes maximum immediately after activation, elapses.

In this case, the time for completion of activation is a short 36seconds, but the maximum value of the total current becomes a large 32A.

When desiring to lower the rush current further in the method ofactivation of FIG. 31, as shown in FIG. 32, it is sufficient tosuccessively activate groups #1 to #4 while shifting the activation time30 seconds. In this case, the time for completion of activation becomesa long 240 seconds, but the maximum value of the rush current can beheld to half, that is, 16A.

In such a conventional method of activation of the magnetic diskapparatus, however, there are the conflicting problems that if theactivation time is shortened, the maximum value of the rush currentbecomes larger and it is not possible to reduce the power capacity,while if activating the units so as to hold down the power capacity, thestart-up time becomes longer.

The present invention has as its object the control of activation toenable the rush current to be held down and at the same time thestart-up time to be shortened.

FIG. 24 is an explanatory view of the method of activation according tothe present invention.

First, the present invention, as shown in FIG. 24(A), is characterizedby, when inputting power to activate a plurality of magnetic diskmodules, dividing the plurality of magnetic disk modules into aplurality of groups of the same number of units and activating themsuccessively while changing the time interval for each group.

Here, the groups are successively activated while shifted by at leastexactly the time (ΔT) during which the maximum rush current flowsdirectly after activation. Further, as shown in FIG. 24(A), processingis repeated so that, first, two groups are successively activated andshifted by exactly the time (ΔT) during which the rush current flowsdirectly after activation, then the following groups are successivelyactivated so as not to overlap with the activation of the secondactivated group.

Also, as shown in FIG. 24(B), processing may also be repeated so thatthe first two groups are successively activated and shifted by a time(ΔT) during which a rush current flows directly after activation andthen the next two groups are similarly successively activated after thecompletion of activation of the second activated group.

Further, the method of activation of the present invention, as shown inFIG. 24(C), divides the plurality of magnetic disk modules into aplurality of groups of different numbers of units and activates themsuccessively shifted by a predetermined time interval in the order ofthe groups having the larger numbers of units.

In this case, the groups are activated and shifted successively by abouthalf of the activation time each.

Further, the present invention is characterized by dividing a pluralityof magnetic disk modules into a plurality of groups of different numbersof units and successively activating the groups while changing the timeintervals of activation.

In this cases as well, the groups are successively activated and shiftedby at least a time (ΔT) during which the rush current flows directlyafter activation. Further, processing is repeated so that two groups aresuccessively activated and shifted by a time (ΔT) during which the rushcurrent flows directly after activation, then the next two groups aresimilarly activated after the activation of the second activated groupis completed.

According to this method of activation of a magnetic disk apparatus ofthe present invention making use of such a routine, it is possible tohold down the maximum value of the rush current during activation bychanging the intervals of activation among the groups and therebykeeping the power capacity smaller.

Further, by changing the number of units in each group, it is possibleto shorten the activation time without causing a great increase in therush current.

Also, by changing the intervals of activation among the groups andchanging the number of units in each group, it is possible to hold downthe maximum value of the rush current and simultaneously shorten theactivation time.

FIG. 25 is a time chart showing the method of activation of anembodiment of the present invention. In this embodiment, 16 magneticdisk modules are divided into four groups of groups #1 to #4, which aresuccessively activated while changing the time intervals among thegroups.

In FIG. 25, first, the first group #1 is activated at the time t₁. Bythis, a total current of 8A is produced. Next, the four units of thegroup #2 are activated at the time t₂, which is after the elapse of acertain time ΔT=2 seconds during which a rush current flows directlyafter activation. In this state, eight units are in the activated state,so the total current is increased to 16A.

When the activation time of 30 seconds has elapsed from the firstactivation time t₁, the activation of the four units of the group #1 isended and the current becomes the steady current 2A of the fourth unit.When added with the group. #2, the total falls to 10A.

Next, at the time t₃ when the group #2 has finished being activatedafter the elapse of the activation time of 30 seconds, the four units ofthe next group #3 are activated. At this time t₃, the completion ofactivation and the activation of the groups #2 and #3 comesimultaneously, so the activation current 8A of the group #3 is added tothe steady current 4A of the total eight units of the groups #1 and #2to give a total current of 12A.

At the time t₄ when the group #3 finishes being activated after theelapse of 30 seconds, the next group #4 is activated, At the time t₄,the activation current 8A of the four units of the group #4 which arenewly activated is added to the steady current 6A of the 12 units of thegroups #1 to #3 to give a total current of 14A. When the activation ofthe group #4 finally ends at the time t₅, the total current falls to 8A,the total of the steady currents of the 16 units.

In the method of activation of FIG. 25, the activation time from thetime t₁ to the time t₅ is 92 seconds and the maximum value of the totalcurrent during the activation is 16A. This 16A is half of the maximumvalue of 32A of the activation current in the conventional method shownin FIG. 32. On the other hand; the activation time is a long 92 secondscompared with the 36 seconds, but this 92 seconds is less than half ofthe 240 seconds of the conventional method in the case of a maximumcurrent of 16A shown in FIG. 32.

FIG. 26 is a time chart showing another embodiment of the presentinvention and is a modification of the embodiment of FIG. 25.

That is, in the embodiment of FIG. 25, the groups #1 and #2 areactivated shifted by ΔT=2 seconds, then the groups #3 and #4 areactivated so as not to overlap with the activation of the group #2, butin the embodiment of FIG. 26, the groups #3 and #4 are also activated inthe same way as with the first groups #1 and #2 separated by ΔT=2seconds.

In the embodiment of FIG. 26, the maximum value of the total currentbecomes a larger 20A, but the activation time can be shortened to 64seconds, two-thirds the previous time.

FIG. 27 is a timing chart showing still another embodiment. In thisembodiment, 16 magnetic disk modules are divided into a group #1 of sixunits, a group #2 of three units, a group #3 of five units, and a group#4 of two units, so that each group has a different number of units,then the groups are successively activated at predetermined intervalsshifted by 15 seconds, half of the 30 second activation time of eachgroup, in the order of the groups with the larger numbers of units.

In the embodiment shown in FIG. 27, the maximum value of the rushcurrent during activation is 19A. Further, the activation time from thetime t₁ to t₅ is just 75 seconds. This embodiment is more effective interms of the activation time compared with the embodiment of FIG. 25.Also, the maximum value of the rush current can be reduced compared withthe embodiment of FIG. 26.

FIG. 28 is a time chart showing still another embodiment. Thisembodiment is a combination of the embodiment of FIG. 25 and theembodiment of FIG. 27.

That is, 16 magnetic disk modules are divided into four groups, with thenumber of units in the groups #1, #2, #3, and #4 being made six, three,five, and two. Further, the activation of groups #1 and #2 are shiftedby ΔT=2 seconds. When the activation of the group #2 is ended, thegroups #3 and #4 are similarly activated and shifted by ΔT=2 seconds.

In the embodiment of FIG. 28, the maximum value of the rush currentbecomes 18.5A, while the time becomes the 66 seconds from the time t₁ tot₅. Accordingly, it will be understood that this embodiment of FIG. 28is more advantageous in terms of the maximum value of the rush currentand the activation time compared with the embodiments of FIG. 25 to FIG.27.

FIG. 29 is a flow chart for the realization of the control of activationof the present inventions shown in FIG. 25 to FIG. 28 and performed bythe power controllers 110-1 and 110-2.

In FIG. 29, when an instruction for input of power to the magnetic diskmodules is received from a higher apparatus by a power controller, theroutine proceeds to step S2, where the number X of groups of themagnetic disk modules is input. For example, X=4 for four groups isinput for the number X of groups. Next, the routine proceeds to step S3,where the count n showing the group number is set to n=1. The processingof steps S4 to S6 is then performed to input the number of the magneticdisk modules allocated to the individual groups.

That is, at step S4, the number of magnetic disk modules included in thefirst group set by n=1 is input. At step S5, the count n is incrementedby 1. At step S6, it is judged if the value of the count n has reachedthe number X of groups. The processing of steps S4 to S6 is repeateduntil the set number X of groups is reached. For example, in the case ofX=4 groups, A₁ units are input for the first group, A₂ units for thesecond group, A₃ for the third group, and A₄ for the fourth group.

Next, at step S7, the count n is set to n=1, then the time intervals forthe groups is input at steps S8 to S10.

That is, at step S8, the time Tn from the n-th group set by the value ofthe count n at that time to the next n+1-th group is input. At step S9,the count n is incremented by 1. The processing of step S8 is repeateduntil the count n reaches the group number X at step S10. By this, forexample, the time T₁ is input for the first group, the time T₂ for thesecond group, the time T₃ for the third group, and the time T₄ for thefourth group.

When the number of units in each group and the time intervals finishbeing input, the routine proceeds to step S11, where the count n is onceagain set to n=1 The activation processing is then performed at stepsS12 to S15.

That is, at step S12, a power input signal is sent to the n-th groupdesignated by the count n at that time. At step S13, it is judged if thecount n matches with the group number X. If not matching, then the timercounts until the time Tn previously input at step S14. When the countends, the routine proceeds to step S15, where the count n is incrementedby 1, then the power is input to the next group once again at step S12.When the power is finished being input to all the groups, the count nmatches with the group number X at step S13 and the input is ended.

The number of the magnetic disk modules per group and the time intervalsTn of input for each group, input at steps S4 and S8 of the flow chartof FIG. 29, are prepared as table data in a RAM, for example, on thebasis of the embodiments of FIG. 25 to FIG. 28. This table data can beinput for the control of activation when controlling the input of power.

The above-mentioned embodiment took as an example the case of control ofthe activation of 16 magnetic disk modules divided into four groups, butthe number of the magnetic disk modules and the number of the groups canbe suitably determined in accordance with need.

Also, the time ΔT during which the peak value of the rush current occursand the 30 second activation time are suitably set in accordance withthe magnetic disk modules and are not limited to those in theembodiments of the present invention.

As explained above, according to the method of activation of themagnetic disk apparatus according to the present invention, when aplurality of magnetic disk modules are divided into groups which arecontrolled in activation, by changing the interval of activation amongthe groups or by changing the number of units included in the groups, itis possible to hold down the maximum value of the rush current duringthe activation and at the same time to shorten the start-up time fromthe start of activation to its end as much as possible.

Next, an explanation will be given of the monitoring of power accordingto the present invention. Before explaining the present invention,however, an explanation will be given of the conventional monitoringsystem.

FIG. 40 is a structural view of main power units of a magnetic diskapparatus. That is, it is a structural view of the main power units oftwo systems having common batteries. In the figure, the powercontrollers 1 and 2 are power control apparatuses. The power units A, B,and a are individual power units. The battery units A, B, 0, 1, a, and bare batteries ancillary to these power units. As shown in the figure,the batteries 0 and 1 are batteries common to the power controllers 0and 1. In this construction, the batteries are monitored forincorporation into the system (magnetic disk apparatus).

FIG. 41 is a timing chart of the conventional monitoring andincorporation of batteries. In the figure, M1, M2, and M3 show batterymonitoring times. The ready signals of the batteries show that thebatteries can be used and have started up in a state enablingincorporation into the system ("H" in the figure). Further, the boldlines over the ready signals show the state of the batteriesincorporated into the system.

As shown in the figure, in the prior art, the battery monitoring timesM1 to M3 are constant. At the monitoring time M1, the battery 1 startsup. At the monitoring time M2, the battery 1 is already incorporated inthe system and the battery 2 is in a state able to be incorporated. Theready signal of the battery 3 has not yet risen (was "L" in the figure),so the battery is not in a state able to provide back-up.

When a patrol is performed, the battery is incorporated into the systemin accordance with its state at the monitoring time. For example, evenif the battery 3 is in a state able to provide back-up right after themonitoring time M2, as shown by the bold line, it is not incorporatedinto the system until the monitoring time M3. Note that the monitoringtime M1 means the patrol directly after the input of power.

However, in the above-mentioned conventional system, the batteryfunction is tested by consuming the battery power actually concerned.Accordingly, there is the problem that a common battery would besimultaneously be monitored from two systems (that is, the powercontrollers 0 and 1 of FIG. 40) and, if that monitoring were continuedfor a certain time, the battery itself would end up being ruined orreduced to a state where it could not provide back-up.

Further, a predetermined time is needed until a battery can be chargedfrom a state unable to provide back-up to a state able to provide thesame. This charging time differs depending on the battery. Therefore, tojudge if a battery can provide back-up by monitoring, it is necessary toconfirm that the battery is normal. With the monitoring at predeterminedintervals like M1, M2, and M3 in FIG. 41, the problem arises that thetime before a battery can be started to be used in the apparatus (thatis, incorporation into the system shown by the bold line) ends up beingdelayed.

The present invention has as its object the quick incorporation of abattery into a system by provision of monitoring times at suitable timesand control of the competition from two systems.

The present invention provides a common power monitoring apparatus in asystem having power units and a batteries ancillary to the same for eachof a plurality of systems, for example, two systems, and having powerunits and batteries common with the other systems, wherein

provision is made of a patrol control means PC for giving a signalindicating a battery monitoring operation is in progress and priorityorder to the monitoring of the batteries among a power controller 0 ofone system and a power controller 1 of another system and

when monitoring the battery function accompanying a common power supplyand incorporating the same into the system, the simultaneous monitoringof a battery and the timing of incorporation of the battery into thesystem are controlled.

Here, the power control apparatus monitors the ready state of a batteryat suitable times. If it detects that the battery is in a ready stateenabling back-up, then it immediately starts the monitoring operation ofthat battery. If the battery functions suitably, it incorporates thebattery into the system.

Further, the power control apparatus, when its own apparatus is doingthe monitoring, sends a master signal MAS indicating that to the patrolcontrol means. The patrol control means sends to the power controlapparatus on the side not receiving the master signal an other-systempatrol signal (O-TEST) showing that the other system is engaged in abattery monitoring operation.

In the present invention, by providing a signal which enables judgementthat a battery monitoring operation is in progress at both systems, itis impossible to prevent simultaneous operation of the monitoringfunction between two systems. Further, the charging completion signal iscontinuously checked for the battery in a state unable to performback-up so as to perform the monitoring function and enable detection ofthe state where back-up is possible earlier.

FIG. 33 is a basic structural view of the monitoring of a battery by thepresent invention and shows the construction of the power apparatuses oftwo systems having batteries. As shown in the figure, the batteries 0and 1 are batteries common to the power controllers 0 and 1. Further, inthe present invention, a patrol control means PC is provided forcontrolling the timing of monitoring of the common battery units 0 and 1between the power controllers 0 and 1. MAS is a master signal, which inthis example shows that the power controller 0 side is engaged in apatrol of the common batteries. O-TEST is an other-system patrol signal.When this signal is at the high level, it indicates that the othersystem is engaged in a patrol. These signals are all input from thepower controllers 0 and 1 to the patrol control means PC. The patrolcontrol means, as mentioned later, controls the starting time of thepatrol and instructs the start of the patrol to one based on thepriority right.

FIG. 34 is a view explaining the signal timing of a battery patrol. Asmentioned earlier, O-TEST is a signal showing that the other system isperforming a patrol, while B-TEST is a signal instructing a patrol of abattery. By controlling the other signal patrol signal O-TEST by apatrol control means PC in this way, it is possible to suppress thepatrol of the other systems and possible to prevent consecutive patrolsof a common battery. Note that B-ALM is a battery alarm signal, which,as illustrated, shows the limit of a battery patrol time. When thebattery patrol time has elapsed, this is the charging guarantee time.This time may be up to the period during which the other system patrolsignal O-TEST is at the high level. That is, the period during which theother-system patrol signal O-TEST is at the high level starts from whenthe patrol from one system is suppressed. Accordingly, when the periodduring which the other-system patrol signal O-TEST is at the high levelpasses, it is possible to use this as the time for guaranteeing thepatrol interval in the system.

FIG. 35 is a timing chart of the monitoring and incorporation of thebattery of the present invention. In the same way as in FIG. 41, M1, M2,. . . are monitoring times. The bold lines on the top of the readysignals indicate a state incorporated into the system. Further, the "L"of the ready signal indicates a state where back-up is not possible(that is, charging is in progress), while "H" indicates a state whereback-up is possible. At the monitoring time M1, a patrol is performedand only the battery BTU-1 is incorporated into the system, then, in thepresent invention, rather than perform a patrol at predetermined timeintervals as in the past, just the ready signals of the batteries BTU-2and BTU-3 are successively monitored.

That is, if it is detected that the ready signal is ON ("H"), as shownby the monitoring time M4, the patrol of the battery 2 is immediatelyexecuted. If in a state where back-up is possible, as shown by the boldline, this is immediately incorporated into the system. Similarly, if itis detected that the ready signal is "H" for the battery 3, then asshown by the monitoring time M4, the patrol is immediately executed. Ifthe battery is in a state enabling use for back-up, as shown by the boldline, it is immediately incorporated into the system. Note that themonitoring time M1 is just after the power is turned on, the monitoringtime M2 is a certain time after the monitoring time M1, and themonitoring time M3 is a certain time after the monitoring time M2.Further, the monitoring time M4 is the time just after the "h" of theready signal is detected, while the monitoring time M5 is apredetermined time from the monitoring time M4. In this way, in thepresent invention, by successively executing just the ready signals anddetecting if the ready signals are ON, the battery patrols areimmediately performed, so it is possible to quickly incorporate thebatteries into the system.

FIG. 36 is a signal timing chart of a battery patrol at the time ofcompetition according to the present invention. In the figure, there isshown the method of patrol control in two systems. As mentioned earlier,MAS is a master signal. When it is ON, that is, at the high level (H),it indicates to perform a patrol. O-TEST is an other-system patrolsignal. When this signal is at the high level, it indicates that apatrol is to be performed. B-TEST is a battery patrol instructionsignal. When at a high level, it indicates that a battery patrol isbeing performed.

When the 0 system and the 1 system are not identical in timing, as shownby the time [1], a certain sequence is followed, but when they try tostart a patrol simultaneously, as shown by the time [3], or when onetries to start a patrol when the other system is already engaged in it,as shown by the time [2], control is exercised as follows. This controlis performed by the power controllers 0 and 1.

When starting a patrol, first, it is detected if the other-system patrolsignal O-TEST is "high" or "low" to confirm that the other system is notengaged in a patrol. If the other-system patrol signal O-TEST is ON andthe other system is already engaged in a patrol, the time until theother system ends it is set and the time of start of the patrol isshifted. This is shown by the "withdrawal" in the figure.

On the other hand, when both systems try to start the patrolsimultaneously, the system with a lower order of priority turns off theother-system patrol signal O-TEST, that is, makes it low, while thesystem with the priority right waits until the other-system patrolsignal O-TEST is turned off, then starts the patrol.

FIG. 37 to FIG. 39 are flow charts of the processing routine of thepower monitoring apparatus of the present invention. If the start of thebattery patrol is instructed (S1), first, it is judged if a battery ismounted (S2). If not mounted, improper mounting is reported (S3). Ifmounted, then it is judged if the battery itself is abnormal (S4). Ifabnormal, a battery abnormality is reported (S5). Next, it is judged ifthe ready signal of the battery is high (1) or low (0) (S6). If low,then it is judged if four hours have been exceeded (S7). If exceeded,then a charging abnormality is reported (S8). If four hours have notbeen exceeded, then the monitoring of the ready signal is continued(S9).

At step S6, if the ready signal is high, the battery ready flag is set(S10). It is judged if it is the initial flag or not (S11). Two hoursare set and the initial flag is reset (S12). Next, it is judged if twohours have been exceeded (S13). If not exceeded, this is awaited. Ifexceeded, it is judged if the other-system patrol signal O-TEST is highor not (S14). If exceeded, the delay timer is set (S15) and this isawaited.

If the O-TEST is not high, this is set (S16) and it is judged once againif O-TEST is high (S17). If not high, it is judged if a certain time haselapsed (S18).

If a certain time has elapsed at step 18, the battery test is performed(S19) and it is judged if another time has elapsed (S20). If it haselapsed, the O-TEST is reset (S21) and it is judged if there is an errorin the patrol (S22). If there is an error, the patrol error is reported(S23), while if there is no error, the battery is recorded (S24) and thetwo-hour timer is initialized (S25), whereby the routine ends.

On the other hand, if O-TEST is high at step S17, the master signal isjudged (S26). If there is no master signal, O-TEST is reset (S27), thedelay timer is set (S28), the system waits. If there is a master signal,the timer is initialized (S29) and it is judged if a certain time haselapsed (S30). If that time has elapsed, the battery test is performed(S19).

As explained above, according to the monitoring of the power by thepresent invention, in a battery patrol, it is possible to preventsimultaneous control of a common battery by one system and anothersystem and therefore to prevent poor judgement due to mistaken operationof the battery and prevent a shift to a state where back-up is notpossible due to abnormal consumption caused by consecutive patrols.

Next, an explanation will be made of the control of switching of poweraccording to the present invention. Before explaining the presentinvention, however, an explanation will be made of the conventionalconstruction.

FIG. 45 is a structural view of the conventional power apparatuses oftwo systems having common batteries.

The power controller 0 is provided with battery units, power units, andconverter controllers controlled by firmware. The power controller 1 hasthe same configuration.

In such a configuration, the conventional sequence of power control hadbeen as follows: When there is an ON instruction for the power of thepower controller 0 side, that is, the 0 system, the power controller 0instructs the input of power, based on a sequence predetermined byfirmware, in the sequence of the power unit 00→02→ converter controller00→02→battery unit 00→02 by instructions to the battery unit controlcircuit, the power unit control circuit, and the power controller. Onthe other hand, the same is performed for the power controller 1 side,that is, the 1 system as the 0 system. The power controller 1 instructsthe input of power in the sequence of the power unit 10→12→ convertercontroller 10→02→ battery unit 10→12. Therefore, the convertercontroller 02 requires a circuit construction enabling control from thepower control apparatuses of both the 0 and 1 systems, resulting in acircuit construction different from that of the converter controllers 00and 10 of just the 0 system or just the 1 system.

In the above-mentioned conventional structure, as mentioned earlier, theconverter controller 02 has a circuit construction enabling control frompower controllers of two systems. This ends up being a complicatedcircuit structure different from those of the power controllers 00 and10 of just the 0 system or the 1 system. Since common designs cannot beused, there are limits as to the common use of components and this leadsto higher costs.

Also, when the battery unit 02 of the 0 system is normal, and thebattery unit 12 of the 1 system is abnormal, even if a short powerfailure occurs, for example, the 1 system would not be judged as beingable to be backed up due to the abnormality of the battery unit 12 anddespite the battery unit 02 being normal, the power to the 1 systemwould be turned off, resulting in operation of only the single system ofthe power controller 0.

Further, as shown in the figure, when backing up apparatuses having acommon power supply, the practice had been to connect a battery to eachsystem. Therefore, there were two batteries at the common portion (inthe figure, the battery units 02 and 12) and therefore there was theproblem of a larger mounting space required.

Further, when there are common batteries, due to providing two systemsof power control, the battery tests are performed simultaneously whenthe power is turned on. This leads to detection of the batteries asbeing defective, causes more than necessary battery consumption, andspeeds the battery deterioration.

The present invention has as its object the common use of power suppliesand batteries, providing one each instead of one for each system, andthe provision of a cross control circuit between two power controlapparatuses for switching the connection between these and the powersupply and battery so as to reduce the number of power supplies andbatteries and thereby achieve common use and reduction of components,and also the prevention of competition in battery tests by the provisionof an address setting circuit for setting which battery test to perform.

The present invention provides a power apparatus in a magnetic diskapparatus having a power unit and battery unit ancillary to the powerunit for each of a plurality of systems, for example, two systems, andhaving a power unit and ancillary battery unit common with othersystems, wherein provision is made of a cross-control means X for crosscontrolling the connection to the common power supply and batterybetween a power controller 0 of one system and a power controller 1 ofanother system. An address setting means AD is provided for setting anaddress showing one's own apparatus in each of the power controlapparatuses,

the common power unit and ancillary battery unit being commonly used forthe two systems by switching the cross control means X on the basis ofthe address of a selected one of the systems.

Further, by setting the address of one's own system by the addresssetting circuit, the battery test and monitoring are made to beperformed from only one system.

The present invention provides a cross control circuit X between thepower control apparatuses of the two systems, whereby control of thepower unit 02 and the battery unit 02 is made possible in common fromthe power controllers 0 and 1. By this, it is sufficient to provide asingle battery, converter controller, power supply, etc. to the systemwith a power supply subject to common control and thus reduce the numberof components and make common use of the same. Further, by providing thetwo systems with an address setting means, the starting times of thebattery tests are changed so as to prevent battery tests being performedsimultaneously from two systems.

FIG. 42 is a structural view of the principle of control of switching ofpower according to the present invention.

The power controller 0 is provided with a battery unit, controlled byfirmware, a power unit, and a converter controller. Further, it isprovided with an address setting circuit AD for controlling thesimultaneous battery tests from two systems. The power controller 1 hasa similar construction.

Further, separate provision is made of a cross control circuit X forswitching the connection between the power control circuits of the twosystems and a common power supply.

As is clear from the above construction, while the power units 02 and 12and the battery units 02 and 12 were required in the conventionalconstruction, in the present invention, common use is made of the singlepower unit 02 and the single battery unit 02. To enable such aconstruction, control is performed through the cross control circuit Xconnected to the power controller 0 and 1.

Further, by the power-on instruction from one of the power controllers 0or 1, the power unit 02 and the battery unit 02 are instructed to turnthe power on. Further, by issuing the power-off instruction from both ofthe power controllers 0 and 1, the power unit 02 and the battery unit 02are instructed to turn off. Further, the state of the battery unit 02can be grasped from both of the power controllers 0 and 1 and throughthe cross control circuit.

By such a construction, the control of the power unit, convertercontroller, and battery unit become completely the same, making use ofcommon designs and common components possible

FIG. 43 is a structural view of an embodiment of a cross control circuitshown in FIG. 42. As shown in the figure, the cross control circuit X iscomprised of three OR gates OR1, OR2, and OR3. Signals of two systemsare input to the OR gates. Therefore, if one of the inputs is on, an ONsignal is output. For example, if the battery unit 02 receives an ONinstruction from one of the power controller systems 0 or 1, the batteryunit 02 is turned on. The rest of the construction is the same, so willnot be explained.

FIG. 44 is a flow chart of the start of the battery test of the presentinvention and shows in particular a flow chart for setting a timervalue. When there is competition in the battery tests when the power ison, an address is given to each of the power controllers 0 and 1, theaddresses are read into firmware, and the timer is initialized so thatthe times for the start of the battery tests are made different for thepower controllers 0 and 1, thereby preventing competition.

In FIG. 44, if the start of a battery test is instructed (S1), it isjudged if the power is on or not (S2). Further, it is judged if theaddress is for the power controller 0 or 1 (S3). If for the powercontroller 0, the timer is set to M seconds (S4). If the powercontroller 1, the timer is set to N seconds (S5). Next, for each of theM seconds of the power controller 0 system and the N seconds of thepower controller 1 system, it is judged if the timer has exceeded theset time (S6). if it has not exceeded it, the battery test is performed(S7) and the predetermined test ended (S8). Here, M<<N.

As explained above, according to the power-cut-off control according tothe present invention, by enabling cross control of the battery, it ispossible to reduce the number of batteries installed per system and toreduce the size of the system construction and, further, possible tomake use of common designs for the power unit. Also, it is possible toavoid simultaneous operation of the battery tests, so the battery lifeis improved and the common components appear the same from all systems,so it is possible to obtain a correct grasp of the state of the systembatteries and to remarkably improve the reliability at the time ofback-up.

Next, an explanation will be given of the analysis of the causes ofpower cut-offs according to the present invention. Before explaining thepresent invention, however, an explanation will be given of theconventional construction and its problems.

FIG. 48 is a basic structural view of the conventional supply of powerand control of cut-off. FIG. 49 is a flow chart of the power cut-offcontrol system in the construction of FIG. 48. In FIG. 48, the magneticdisk control apparatus 720 is divided schematically into a main powerunit 721 and a functional unit 722 for simplification of theexplanation. Accordingly, the power unit and the battery units areincluded in the main power unit 721 of the construction of FIG. 48. Therest of the construction is included in the functional unit 722. Thefirst storage device 723 is a storage device for recording the historyof occurrence of breakdowns such as stoppages of operation of thesystem. Note that IF is a power control interface between a higherapparatus 710 and the magnetic disk control apparatus 720, AC is ACpower, and DC is DC power. Further, while explained in FIG. 49, RS is apower cut-off request signal sent from the power unit 721, and AS is apower cut-off authorization signal sent from the functional unit 722.

In FIG. 49, when the main power unit 721 receives an instruction fordetection of a power failure or cut-off of power from the higherapparatus 710, such as a host computer, or by operation by an operatorthrough a power control interface IF (S1), first, the main power unit721 switches the power supply to the functional unit 722 from the powerunit to the batteries (S2), then the main power unit 721 holds thebattery output for a predetermined period (S3). That is, theconstruction enables the power of the system to be maintained for apredetermined period during a power failure by use of the back-upbatteries. Next, the main power unit 721 sends out to the functionalunit 722 a power cut-off request signal RS notifying it that it wishesto cut off the power.

The functional unit 722, when receiving this power cut-off requestsignal RS, performs predetermined processing for cutting off the power,such as preparations for the power cut-off (S5). Further, when thepredetermined processing ends, it sends a power cut-off authorizationsignal AS to the main power unit 721 (S6) to notify the main power unit721 that it is all right to cut off the power.

The main power unit 721, when receiving this power cut-off authorizationsignal AS, first judges if the power cut-off authorization signal AS hasbeen received (S7). If this signal AS has been received, it performs theprocessing for cutting off the power (S8), whereafter the power cut-offprocessing ends. Further, if the signal AS has not yet been receivedfrom the functional unit 722 at step S7, the judgement of this step isrepeated.

In this way, if the main power unit 721 detects a power failure, itswitches to the battery for the power supply. When a predetermined timeelapses, it automatically cuts off the batteries by the same routine aswhen it receives a normal power cut-off instruction. Further, at thetime of the next input of power, it charges the used batteries toprepare for the next power failure.

However, the first storage device in the conventional construction onlyrecorded the history of the occurrence of breakdowns, such as stoppagesof the system operation, as mentioned earlier, and did not record thehistory of the state of use of the power, such as power cut-offs.Therefore, there were the following problems:

[1] When the power was cut off due to a power failure, it was notpossible to notify the higher apparatus or the operator for what reasonthe power was cut off.

[2] When a battery is in the charging state at the time of the nextinput of power, it is not possible to determine why it is in thecharging state.

[3] The time when a battery has deteriorated cannot be estimated.Therefore, the time for replacement of the battery cannot be determined.

The present invention has as its object to enable the easy analysis ofthe causes of power cut-off.

FIG. 46 is a structural view of the principle of the analysis of thecauses of power cut-off according to the present invention.

According to the present invention, there is provided a power cut-offcontrol apparatus in a file control system comprised by a higherapparatus, a magnetic disk apparatus, and a magnetic disk controlapparatus provided between the same, wherein

a main power unit 721 is provided with a power unit for supplying powerto the drive modules and battery units for backing up the power during apower failure, while a functional unit 722' is provided with a firststorage device 723 for recording the history of the power, such as theoccurrence of breakdowns, and also a second storage device 724 forobtaining a log of the state of use of the power,

the main power unit sends to the functional unit at the time the powerto the system is cut off a back-up signal BS indicating that the back-upbatteries have been used due to a power failure and an automatic cut-offsignal CS indicating that the power has been automatically cut off dueto the elapse of the maximum discharge time after switching to thebatteries,

next, a power cut-off request signal RS is sent from the main power unitto the functional unit, the functional unit, when receiving the powercut-off request signal, performs the predetermined processing, includingpreparations for power cut-off, then sends a power cut-off authorizationsignal AS to the main power unit, and the second storage device of thefunctional unit logs the back-up signal and the automatic cut-off signalwhen receiving the power cut-off request signal, and

the state of use of the power, such as the previous cut-off of power, isjudged at the time of the next input of power by referring to the secondstorage device.

Here, the automatic cut-off signal CS can be set to a high level whengiving notification that the power has been automatically cut off afterthe elapse of the maximum discharge time of the batteries and to a lowlevel when forcibly cutting off the power before the elapse of themaximum discharge time.

Further, the second storage device can use part of the memory area ofthe first storage device. Also, the first and second storage devices canuse hard disks.

In the present invention, the back-up signal notifying that thebatteries are being used due to a power failure and the automaticcut-off signal notifying that the power was automatically cut off sincea predetermined time (maximum discharge time of batteries) elapsed afterswitching to the batteries are sent to the functional unit beforesending out a power cut-off request signal. The functional unit isprovided with a second storage means for recording the state of use ofthe power. These signals are logged in the second storage means.Therefore, by referring to the second storage means before the nextinput of power, it is possible to easily analyze the state of use of thepower and the causes of power cut-off. Note that the second storagemeans need not be separately provided, but can be comprised using a partof the memory area of the first storage means and also can be comprisedusing a hard disk.

FIG. 47 is a flow chart of the processing routine of the construction ofFIG. 46. In the figure, constituent elements the same as those in FIG.46 are given the same reference numerals. In the present invention, thefunctional unit 722' is provided with a second storage device 724 forrecording the history of the state of use of the power, such as powerstoppages. Note that BS is the battery back-up signal from the mainpower unit 721 and CS is the automatic cut-off signal from the mainpower unit 721.

In FIG. 47, in the same way as mentioned above, when the main power unit721 receives an instruction for detection of a power failure or cut-offof power from a higher apparatus 710, such as a host computer, or byoperation by an operator through a power control interface IF (S1),first, the main power unit 721 switches the power supply to thefunctional unit 722' from the power unit to the batteries (S2), then themain power unit 721 holds the battery output for a predetermined period(S3). That is, the construction enables the power of the system to bemaintained for a predetermined period during a power failure by use ofthe back-up batteries. Next, the main power unit 721 sends out to thefunctional unit 722' a back-up signal BS notifying it that the batteriesare being used due to a power failure and an automatic cut-off signal CSnotifying it that it is desired to cut off the power automatically sincethe maximum discharge time of the batteries has been reached. The mainpower unit 721 next sends a power cut-off request signal RS to thefunctional unit 722'.

The functional unit 722', when receiving the power cut-off requestsignal RS, performs predetermined processing such as preparation for apower cut-off (S6), then logs (stores) the back-up signal BS and theautomatic cut-off signal CS in the second storage device 724. When thelogging in the second storage device 724 has been finished, it sends tothe main power unit 721 a power cut-off authorization signal AS (S8).The main power unit 721 judges if a power cut-off authorization signalAS has been received and if the signal AS has been received, cuts offthe battery output used up to then (S10) and ends the power cut-offprocessing (S11). Note that, as mentioned above, by making the automaticcut-off signal CS the high level when automatically cutting off thepower due to the elapse of the maximum discharge time of the batteriesand by making the automatic cut-off signal CS the low level whenforcibly cutting off the power during the use of the batteries, it ispossible to store the data in the second storage device 724 in bothcases.

As explained above, in the present invention, provision is made of aback-up signal, automatic cut-off signal, and a second storage means forlogging these signals. By referring to the second storage means later,there are the following effects:

[1] It is learned if a battery has been used at the time of powercut-off.

[2] It is possible to judge if the power unit has been automatically cutoff due to a power failure.

[3] When a battery is in a charging state at the time of input of power,it is learned if this charging is due to the use of the battery due to aprevious power cut-off or is due to self-charging due to deterioration,which can serve as a guide for battery replacement.

[4] By investigating the frequency of maximum discharge of a battery, itis possible to estimate the deterioration of the battery, which can beused as a guide for its replacement.

Next, an explanation will be made of a power maintenance display meansaccording to the present invention. Before explaining the presentinvention, however, an explanation will be made of the basicconstruction of the system.

FIG. 52 is a basic structural view of a file control system, inparticular, a structural view of key portions of a magnetic disk controlapparatus. As mentioned earlier, the magnetic disk control apparatus isbasically comprised of a main power unit 821 and a functional unit 822.The main power unit 821 is comprised of a power unit for converting ACvoltage to DC voltage and supplying the same to the functional unit andbattery units for providing back-up during power failures. Further, thefunctional unit 822 is mainly comprised of drive modules, not shown. Inthe figure, IF is a power control interface between the higher apparatus810 and a power unit 821, RS is a power cut-off request signal sent outfrom the main power unit to the functional unit when the batteries arebeing used, and AS is a power cut-off authorization signal sent from thefunctional unit to the main power unit.

As explained below, in such a file control system, when starting up thesystem, usually power is input or cut off to or from all the units atone time from the higher apparatus or an operator from a remotelocation. On the other hand, during maintenance and inspection of thesystem, it is supposed to be possible to cut off the power forindividual units.

FIG. 53 is a structural view of key portions of the area around thepower supply in the system of FIG. 52. In the figure, 811, as mentionedearlier, is the power control interface between the higher apparatus 810and the power unit, 812 is an R/L switch for switching between REMOTEand LOCAL, 813 is a power control unit for inputting and cutting offpower, 814 is a power maintenance panel with various switches, and 815is an apparatus front panel with various switches for the system.

In the figure, C1 is a power-on signal from the power control interface811, and C2 is a power-on signal from the power maintenance panel. C3 isan R/L signal from the R/L switch 812, and C4 is a power-on signal. Thesignals C3 and C4 are input to the power control unit 813, while thepower input instruction signal C5 is sent to the power unit 821. As aresult, the main power unit 821 can supply power to the functional unit822. Note that D1 is a data bus for data sent out from the power controlunit 13 to the panels 14 and 15.

In this case, when instructing the input of power from a higherapparatus, the R/L switch 812 must be at the "REMOTE" side. On the otherhand, when instructing the input of power for individual units, the R/Lswitch 812 must be at the "LOCAL" side.

FIG. 54 is a structural view of key portions of a conventional powermaintenance panel. As shown in the figure, this is provided with an R/Lswitch for switching between "REMOTE" and "LOCAL" and an on/off switchfor inputting and cutting off power. Usually, the R/L switch is at the"REMOTE" side to enable remote input of power to all units all at once.At the time of individual maintenance and inspection of units, the R/Lswitch is switched to the "LOCAL" side to enable individual cut-off ofpower.

FIG. 55 is a flow chart of a conventional maintenance routine. Asmentioned earlier, the power is normally input to and cut off fromapparatus by the higher apparatus 810 through a power control interface811. That is, the R/L switch 812 is supposed to be at the "REMOTE" sideand the power input or cut off by the power on/off switch. Therefore,the operator can input and cut off the power of the apparatus from aremote location.

On the other hand, when starting the maintenance work on the apparatus(S1), the maintenance worker switches the R/L switch to the "LOCAL" sideonce (S2) and uses the power on/off switch to cut off the power (S3).This is to prevent the power from being input to the apparatusmistakenly from a remote location during the maintenance work. Theworker performs the maintenance work (S4) and when the predeterminedmaintenance work is finished, uses the power on/off switch to inputpower to the apparatus (S5) and judges if the apparatus starts upnormally (S6). When operating normally, he then cuts off the power tothe apparatus and switches the R/L switch to the "REMOTE" side torestore the apparatus to its normal state, which completes themaintenance work (S8).

When finishing the maintenance work such as at the above-mentioned stepS8, the maintenance worker is supposed to switch the R/L switch to the"REMOTE" side. However, the maintenance worker sometimes forgets thisprocedure, in which case he ends the maintenance work leaving the R/Lswitch at the "LOCAL" side. Accordingly, since the R/L switch is not atthe "REMOTE" side, when next trying to input power from a remotelocation, the power cannot be input to that apparatus.

The present invention has as its object to enable the reliableprevention of omission of switching of the R/L switch at the time of theend of the Maintenance work.

FIG. 50 is a structural view of key portions of the power maintenancepanel according to the present invention. The present invention providesa magnetic disk control apparatus in a file control system in whichprovision is made, on a power maintenance panel of the system, of:

a power on/off switch which is operated manually at the time ofmaintenance work or controlled by a higher apparatus through a powercontrol interface so as to input or cut off power,

an R/L switch for switching between a side enabling remote input andcut-off of power (REMOTE) and a side enabling local input and cut-off ofpower (LOCAL), and

a display means for displaying the state of the R/L switch,

the R/L switch being switched to the "LOCAL" side, then the power on/offswitch being used to cut off the power during maintenance work on theapparatus, then, after the end of the maintenance work, the R/L switchbeing switched to the "REMOTE" side and this being displayed on thedisplay means.

In the present invention, provision is made of a display means fordisplaying the state of the R/L switch on the power maintenance panel.The power control unit 813 is provided with a means enabling detectionof the state of the R/L switch, that is, if it is at the "REMOTE" sideor the "LOCAL" side. When the "LOCAL" side, that state is displayed onthe display means, whereby the maintenance worker is alerted to changeit to the "REMOTE" side.

FIG. 51 is a flow chart of the processing routine of maintenance work ofthe present invention. Steps S1 to S6 are the same as in the pastroutine shown in FIG. 55. That is, when starting the maintenance work ofthe apparatus (S1), the maintenance worker switches the R/L switch ofthe power maintenance panel to the "LOCAL" side (S2) and cuts off thepower by the power on/off switch (S3). Then, he performs the maintenancework (S4). When the predetermined maintenance work is finished, he turnson the power of the apparatus by the power on/off switch (S5) and judgesif the apparatus starts up normally or not (S6). The fact that the powerof the apparatus has been turned on by the power on/off switch at stepS5 is displayed by a code, for example, on the display means of thepower maintenance panel (S7).

If the maintenance worker can confirm at step S6 that the apparatus isstarting up normally, he cuts the power of the apparatus, switches theR/L switch to the "REMOTE" side (S8), checks the display on the powermaintenance panel (S9), and ends the maintenance work (S10).

In this case, the power control unit 813 shown in FIG. 53 judges thestate of the R/L switch 812. When it is the "LOCAL" state, that isdisplayed on the display means. The maintenance worker therefore knowsthat the state is still the "LOCAL" state and switches the R/L switch tothe "REMOTE" state. When the internal power control unit 813 detectsthat the state has become the "REMOTE" state, the display means isinstructed to display a code. Note that the method of display in thedisplay means may be any suitable method, such as "00" when switched tothe "REMOTE" state and "11" when switched to the "LOCAL" state.

FIG. 56 is a perspective view of the exterior of a magnetic diskapparatus to which the present invention is applied.

The results of the routine explained in FIG. 51 are displayed on adisplay means of the power maintenance panel 814 shown in FIG. 50.Further, the power maintenance panel is provided at the top of the frontpanel of FIG. 56.

As explained above, the maintenance panel display of the presentinvention enables the state of the R/L switch to be understood at aglance at the time of the end of the maintenance work, so it is possibleto reduce work errors. Further, when power cannot be input from thehigher apparatus, the reason why the power cannot be input can beimmediately found and the maintenance time shortened.

CAPABILITY OF EXPLOITATION IN INDUSTRY

A magnetic disk apparatus used as a subsystem of a medium-sized computersystem used in offices etc., according to the present invention, isprovided with separate individual back-up batteries for the systems ofthe director units and magnetic disk modules and the power is suppliedand controlled in accordance with the operating states of the directorunits, so it is possible to make the back-up batteries more compact andthereby possible to provide a magnetic disk apparatus which is compactand higher in density and satisfies fire prevention laws as well,thereby greatly increasing the capability of utilization in industry.

What is claimed is:
 1. A magnetic disk apparatus having at least twosystems each including at least one power unit and at least one batteryunit ancillary to the power unit, and at least one common power unithaving a pluralities of batteries attached thereto connected in commonwith the two systems, the apparatus comprising:patrol control means (PC)operatively connected to a power control unit (0) of one system and apower control unit (1) of another system for giving a control signalduring a battery monitoring operation and a priority order to thebattery monitoring operation, the patrol control means monitoring thefunction of the common batteries attached to the common power unit and,further, when the common batteries are incorporated in the magnetic diskapparatus, controls the simultaneous monitoring of the common batteriesand the time of incorporation of the common batteries into the magneticdisk apparatus; wherein when one of the at least two systems ismonitoring the common batteries, the power control unit of the one ofthe at least two system sends a master signal MAS to the patrol controlmeans (PC) indicating that the one of the at least two systems ismonitoring the common batteries, and the patrol control means sends another-system patrol signal O-TST to the other of the at least two systemindicating that the one of the two at least two system is monitoring thecommon batteries.
 2. A magnetic disk apparatus having at least twosystems each including power units and battery units ancillary to thepower units, and also having at least one common power unit and at leastone common battery connected in common with the at least two systems,the apparatus comprisingcross control means (X) for cross-controllingthe connection to the common power unit and the common battery between apower control unit (o) of one system and a power control unit (1) ofanother system; and address setting means (AD) provided in each of thepower control units (0) and (1) for setting the address of respectivepower control units (0) and (1) in which the address setting means isprovided; wherein the cross control means is switched based on anaddress of a selected one system.
 3. A magnetic disk apparatus as setforth in claim 2, characterized in that a battery test and monitoringare performed only for one system by setting the address of the onesystem by the address setting means.
 4. A magnetic disk controlapparatus provided in a file control system, comprising:at least a mainpower unit and a functional unit for performing a control of a cut-offof power, the main power unit (720) including a power unit for supplyingpower and at least one battery unit for backing up the power at a timeof power failure, the functional unit (722') including first storagemeans (723) for recording the history of occurrence of breakdowns andalso second storage means (724) for obtaining a log of a state of use ofthe power, wherein the main power unit sends to the functional unit whenthe power of the system is cut off a back-up signal (BS) indicating thatthe back-up battery is being used due to a power failure and anautomatic cut-off signal (CS) indicating that the power will beautomatically cut off along with the elapse of a maximum discharge timeafter switching to the battery, and when a power cut-off request signal(RS) is sent from the main power unit to the functional unit and thefunctional unit receives the power cut-off request signal, thefunctional unit performs a predetermined processing includingpreparations for power cut-off, then sends a power cut-off signal (AS)to the main power unit; the second storage means of the functional unitlogs the back-up signal and the automatic cut-off signal when receivingthe power cut-off request signal; and the second storage means isreferred to so as to judge the state of use of the power relating atleast to the previous power cut-off when next inputting power.
 5. Amagnetic disk control apparatus as set forth in claim 4, characterizedin that the automatic cut-off signal (CS) is set to a high level whennotifying the fact that the power is automatically cut off after theelapse of a maximum discharge time of the battery and is set to the lowlevel when the power is forcibly cut off before the elapse of themaximum discharge time.
 6. A magnetic disk control apparatus as setforth in claim 4, characterized in that the second storage means uses apart of the memory area of the first storage means.
 7. A magnetic diskcontrol apparatus as set forth in claim 4, characterized in that thefirst and second storage means use a hard disk.